Executive brief
The Linux kernel's AMD CPU frequency scaling driver can crash when handling CPU power management settings if a CPU is taken offline or the driver is unloaded at the wrong time. This crash would cause a denial of service, potentially affecting systems that rely on dynamic CPU power management and requiring a reboot to recover.
Technical details
The vulnerability is a NULL pointer dereference in the AMD pstate cpufreq driver's dynamic EPP (Energy Performance Preference) callbacks. The functions amd_pstate_power_supply_notifier() and amd_pstate_profile_set() call cpufreq_cpu_get() to acquire a CPU frequency policy, which can return NULL if the CPU is offline or the policy has been torn down. These functions then unconditionally dereference the returned pointer, passing it to amd_pstate_get_balanced_epp() and amd_pstate_set_epp(). A race condition between CPU hotplug or driver teardown can trigger the NULL dereference. The fix adds NULL checks before dereferencing the policy pointer, returning NOTIFY_OK or -ENODEV appropriately. This is a kernel defect found by code inspection, not exploited in the wild, and patched in multiple kernel stable branches.
Affected products
- Linux Linux Kernel multiple versions (2.6.11 through 7.2 in stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-07-22: patched: Fix committed upstream