Executive brief
A vulnerability was identified in the Linux kernel's CPU frequency management component. This component is responsible for adjusting processor speed to save power or improve performance. An error in how the system handles initialization failures could allow a 'double free' memory corruption event, potentially leading to a system crash or allowing an attacker to gain elevated privileges on the affected machine.
Technical details
A double-free vulnerability exists in the Linux kernel's cpufreq governor during error handling in cpufreq_dbs_governor_init(). When kobject_init_and_add() fails, the function calls kobject_put(), which triggers the cpufreq_dbs_data_release() callback to free dbs_data. However, the error path subsequently attempts to free the same dbs_data object again. This flaw can be triggered by a local attacker to cause a denial of service (system crash) or potentially achieve arbitrary code execution in kernel mode. The fix involves restructuring the error path to ensure kobject_put() handles the cleanup exclusively after kobject initialization has been attempted.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2026-04-01: other: Patch submitted by developer
- 2026-05-08: advisory: CVE published by kernel.org and NVD
References
- https://git.kernel.org/stable/c/019ea28629720c220daedf38107c8787f330dc05
- https://git.kernel.org/stable/c/3bf9d023d2329a0e5379f2fd09d06ef09729cd9d
- https://git.kernel.org/stable/c/427d048e4f6acbfa01b5a8062449fe0ee8987c0d
- https://git.kernel.org/stable/c/56bc91ee78babe9578585a2bc137abc4b3115ff3
- https://git.kernel.org/stable/c/6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e
- https://git.kernel.org/stable/c/d2703b4f8fb7cc6f0dfdb2dc2359cc46189e7357
- https://git.kernel.org/stable/c/da39ee627fd82b52068d4d5f115749a8b7d271f9