CVE-2025-40194 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
A use-after-free in the Linux kernel's intel_pstate driver can cause a system crash during CPU hot removal, requiring a kernel patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40194?
CVE-2025-40194 is an use after free vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.
Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).
Address this issue by modifying update_qos_request() to drop the reference to the policy later.
Which versions are affected by CVE-2025-40194?
How do I fix CVE-2025-40194?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-40194 being exploited?
There is no known exploitation of CVE-2025-40194 in the wild and no public exploit code.
Sources
Also known as AZL-70094, BELL-CVE-2025-40194, DEBIAN-CVE-2025-40194, GHSA-8qw2-hj59-c25x, ROOT-OS-DEBIAN-11-CVE-2025-40194, ROOT-OS-DEBIAN-13-CVE-2025-40194 and 2 more.