Executive brief
A vulnerability was identified in the Linux kernel's power management component that could allow a local user to crash the system. The issue occurs when the system attempts to manage processor idle states, potentially leading to a complete system freeze or 'Blue Screen' equivalent. This affects system availability and could disrupt ongoing operations or services running on the affected machine.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's ACPI processor driver within the __acpi_processor_start() function. Following changes to how idle drivers are registered, the kernel could attempt to call acpi_processor_power_init() without a valid cpuidle driver being present. This results in a NULL pointer dereference during the execution of __cpuidle_register_device(). A local attacker with basic privileges could potentially trigger this condition to cause a kernel panic and denial of service. Patches have been released for affected stable branches including 6.18.14 and 6.19.4.
Affected products
- Linux Linux Kernel 6.18 to 6.18.14, 6.19 to 6.19.4
Timeline
- 2026-05-06: disclosed
- 2026-06-17: other: CVE was rejected/withdrawn by the CNA after initial publication