Executive brief
A vulnerability exists in the Linux kernel's power management component for Intel processors. On certain system configurations where multi-threading is disabled, the system may crash when attempting to adjust processor speed settings. This could allow a local user to cause a denial-of-service by triggering a system failure.
Technical details
A NULL pointer dereference exists in the update_cpu_qos_request() function within drivers/cpufreq/intel_pstate.c. The vulnerability occurs because the 'freq' variable is initialized by dereferencing 'cpudata' before the code validates the 'policy' or ensures 'cpudata' is non-NULL. This specifically impacts systems booted with the 'nosmt' parameter, where SMT sibling threads have NULL entries in the all_cpu_data array. An attacker with local access could trigger this dereference, leading to a kernel panic (DoS). The issue has been resolved by deferring the variable assignment until after validation checks are performed.
Affected products
- Linux Linux Kernel 6.18 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1
Timeline
- 2026-02-24: patched: Initial patch submitted by David Arcari
- 2026-05-08: disclosed: CVE published
- 2026-05-21: advisory: NVD enrichment and analysis completed