In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active. This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference: Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200 Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress. [ rjw: Changelog edits ]

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/6d5dd354c37abaf4d60400c55c71f23ba2b33639 cve-icon
https://git.kernel.org/stable/c/6e175c00c62dca3d91b987015808b5d52e8db2b4 cve-icon
https://git.kernel.org/stable/c/73255d702c7560185fd5951aadcf7eb057c2f453 cve-icon
https://git.kernel.org/stable/c/9103078c7b3091a2fbb52af176f95982ee7dd7f8 cve-icon
https://git.kernel.org/stable/c/a0106b41f9a724868d390b8b3b4ea5ca0e04ea53 cve-icon
https://git.kernel.org/stable/c/a0ef2fc89d28ca62923376c4b8ffaa57136a36be cve-icon
https://git.kernel.org/stable/c/a9029dd55696c651ee46912afa2a166fa456bb3e cve-icon
https://git.kernel.org/stable/c/cd4524ff6567fa4458a5bec4b017105e671d393e cve-icon
https://lore.kernel.org/linux-cve-announce/2026072523-CVE-2026-64373-2ee3@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-64373 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-64373 cve-icon
History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 26 Jul 2026 02:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-476

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active. This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference: Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200 Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress. [ rjw: Changelog edits ]
Title cpufreq: Fix hotplug-suspend race during reboot
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:25.427Z

Updated: 2026-07-25T08:50:25.427Z

Reserved: 2026-07-19T15:36:31.784Z

Link: CVE-2026-64373

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64373 - Bugzilla