CVE-2026-64373 cpufreq: Fix hotplug-suspend race during reboot
A race condition in the Linux kernel cpufreq subsystem during reboot can cause a null pointer dereference, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64373?
CVE-2026-64373 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: Fix hotplug-suspend race during reboot
During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active.
This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference:
Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200
Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress.
[ rjw: Changelog edits ]
Weakness: CWE-362
Which versions are affected by CVE-2026-64373?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64373?
Apply the vendor's patch.
Is CVE-2026-64373 being exploited?
There is no known exploitation of CVE-2026-64373 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93551, BELL-CVE-2026-64373, DEBIAN-CVE-2026-64373, GHSA-r493-vrrx-v3x2, ROOT-OS-UBUNTU-2204-CVE-2026-64373, UBUNTU-CVE-2026-64373.