CVE-2026-43401 cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request()
A NULL pointer dereference in the Linux kernel cpufreq driver causes a system crash when booted with the nosmt parameter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43401?
CVE-2026-43401 is a medium-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request()
The update_cpu_qos_request() function attempts to initialize the 'freq' variable by dereferencing 'cpudata' before verifying if the 'policy' is valid.
This issue occurs on systems booted with the "nosmt" parameter, where all_cpu_data[cpu] is NULL for the SMT sibling threads. As a result, any call to update_qos_requests() will result in a NULL pointer dereference as the code will attempt to access pstate.turbo_freq using the NULL cpudata pointer.
Also, pstate.turbo_freq may be updated by intel_pstate_get_hwp_cap() after initializing the 'freq' variable, so it is better to defer the 'freq' until intel_pstate_get_hwp_cap() has been called.
Fix this by deferring the 'freq' assignment until after the policy and driver_data have been validated.
[ rjw: Added one paragraph to the changelog ]
Weakness: CWE-476
Which versions are affected by CVE-2026-43401?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43401?
Apply the vendor's patch.
Is CVE-2026-43401 being exploited?
There is no known exploitation of CVE-2026-43401 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43401, DEBIAN-CVE-2026-43401, GHSA-j7hx-vp8g-c83p, UBUNTU-CVE-2026-43401.