Executive brief
A vulnerability in the Linux kernel's power management component can cause certain enterprise servers to crash. On specific hardware configurations, the system incorrectly attempts to access a non-existent power-saving state, leading to an immediate system failure. This affects system availability but does not directly expose customer data.
Technical details
A vulnerability exists in the Linux kernel cpuidle subsystem due to improper handling of platforms with only a single registered idle state (e.g., PowerNV systems without a power-mgt DT node). When the ladder governor is active and only state 0 (polling) is available, the governor may incorrectly attempt to select state 1, resulting in an out-of-bounds index. This leads to a NULL pointer dereference when the kernel attempts to invoke the 'enter' callback for the non-existent state, causing a kernel panic. The issue has been resolved by adding a check in cpuidle_select() to bypass the governor and return state 0 directly when state_count is less than or equal to 1.
Affected products
- Linux Linux Kernel All versions prior to the fix (specifically affecting PowerNV systems)
Timeline
- 2026-02-17: other: Patch authored by Aboorva Devarajan
- 2026-05-27: disclosed: CVE published
- 2026-05-27: patched: Fixes merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/4da2b897283c39980d6ae09dc1560fcd937879e5
- https://git.kernel.org/stable/c/5c577ac939bca486cb02069505cfe47a5312ce02
- https://git.kernel.org/stable/c/5d103a38e2ae96eca57fd17161bcd29bd4622d1c
- https://git.kernel.org/stable/c/63ae78336f40bcd9a44952a7c6bafb9c88a8effd
- https://git.kernel.org/stable/c/8f6833d919bae915ead6c599a53e81e19b32da52
- https://git.kernel.org/stable/c/a0724e40a58a0e323c59707edeae5b71d15800dc
- https://git.kernel.org/stable/c/a0f7e804edc82e513d1ccb7c95ed8b351522ec81