CVE-2026-23332 cpufreq: intel_pstate: Fix crash during turbo disable
A local attacker can cause a kernel crash by disabling turbo mode on systems with limited CPUs, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23332?
CVE-2026-23332 is a medium-severity vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: intel_pstate: Fix crash during turbo disable
When the system is booted with kernel command line argument "nosmt" or "maxcpus" to limit the number of CPUs, disabling turbo via:
echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo
results in a crash:
PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI ... RIP: 0010:store_no_turbo+0x100/0x1f0 ...
This occurs because for_each_possible_cpu() returns CPUs even if they are not online. For those CPUs, all_cpu_data[] will be NULL. Since commit 973207ae3d7c ("cpufreq: intel_pstate: Rearrange max frequency updates handling code"), all_cpu_data[] is dereferenced even for CPUs which are not online, causing the NULL pointer dereference.
To fix that, pass CPU number to intel_pstate_update_max_freq() and use all_cpu_data[] for those CPUs for which there is a valid cpufreq policy.
Weakness: CWE-476
Which versions are affected by CVE-2026-23332?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23332?
Apply the vendor's patch.
Is CVE-2026-23332 being exploited?
There is no known exploitation of CVE-2026-23332 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23332, DEBIAN-CVE-2026-23332, GHSA-76w7-8x62-j4qm, UBUNTU-CVE-2026-23332.