CVE-2026-45968: Linux Kernel cpuidle DoS Vulnerability

CVE-2026-45968 Overview

CVE-2026-45968 is a NULL pointer dereference vulnerability in the Linux kernel's cpuidle subsystem. On certain platforms such as PowerNV systems without a power-mgt device tree node, cpuidle may register only a single idle state. When that lone state is a polling state (state 0), the ladder governor incorrectly treats state 1 as the first usable state and passes an out-of-bounds index. The kernel then invokes a NULL enter callback, producing a system crash. The issue has been resolved upstream by adding a bail-out in cpuidle_select() that returns state 0 directly when state_count <= 1, bypassing the governor and keeping the tick running.

Critical Impact
Local denial of service through a kernel crash triggered when cpuidle registers only a polling idle state on affected platforms.

Affected Products

Linux kernel cpuidle subsystem
PowerNV systems without a power-mgt device tree node
Multiple stable kernel branches as referenced in the upstream commits

Discovery Timeline

2026-05-27 - CVE-2026-45968 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45968

Vulnerability Analysis

The defect lives in the Linux kernel's cpuidle governor selection path. The cpuidle framework manages CPU idle states and delegates state selection to a governor such as ladder or menu. On normal hardware, multiple idle states are registered, and the governor selects an appropriate one based on residency and latency targets.

On PowerNV systems that lack a power-mgt device tree node, only the Snooze polling state is registered. The kernel log shows cpuidle-powernv : Only Snooze is available before the crash. The ladder governor does not account for this corner case and advances past the only valid index, producing an out-of-bounds state selection. The resulting state pointer carries a NULL enter callback, and the kernel jumps to address 0x0 from cpuidle_enter_state+0x2c4/0x668.

Root Cause

The root cause is missing bounds validation in the governor selection logic when state_count <= 1. The ladder governor assumes state 0 is always a non-polling baseline and treats state 1 as the first selectable state. When only one state exists, this assumption produces an out-of-bounds index and a [CWE-476] NULL pointer dereference inside cpuidle_enter_state().

Attack Vector

The condition is reachable on affected hardware during normal CPU idle scheduling, without attacker interaction. A local user cannot directly control idle state registration, so the issue manifests primarily as a reliability and availability defect on systems where only a polling idle state is exposed. The crash occurs in kernel context and halts the affected CPU path.

The vulnerability is described in prose because no proof-of-concept code is required. The upstream fix adds an early return in cpuidle_select() that hands back state 0 when state_count <= 1, bypassing the governor entirely. See the upstream commits in the references for the exact diff.

Detection Methods for CVE-2026-45968

Indicators of Compromise

Kernel log entry cpuidle-powernv : Only Snooze is available followed by a faulting instruction address of 0x00000000.
Kernel oops or panic with LR pointing to cpuidle_enter_state+0x2c4/0x668.
Unexpected reboots or CPU hangs on PowerNV hosts shortly after boot.

Detection Strategies

Inventory Linux hosts and identify kernels predating the fix commits listed in the kernel.org references.
On PowerPC systems, check the device tree for the presence of a power-mgt node and enumerate registered cpuidle states under /sys/devices/system/cpu/cpu0/cpuidle/.
Correlate crash dumps and kdump artifacts that reference cpuidle_enter_state with the kernel build version.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a central log store and alert on cpuidle-powernv warnings paired with faulting address messages.
Track unplanned reboots on PowerNV fleet members and pivot to kernel logs for the preceding boot.
Include kernel version and patch level in asset inventory feeds to detect drift from the patched baseline.

How to Mitigate CVE-2026-45968

Immediate Actions Required

Apply the upstream kernel fix from the referenced commits or upgrade to a stable kernel release containing the bail-out in cpuidle_select().
Prioritize patching for PowerNV hosts and any platform that exposes a single cpuidle state.
Validate that the patched kernel resolves the issue in a staging environment before broad rollout.

Patch Information

The fix is available in multiple stable branches via the upstream kernel commits referenced by NVD, including Kernel Git Commit 4da2b89, Kernel Git Commit 5c577ac, Kernel Git Commit 5d103a3, Kernel Git Commit 63ae783, Kernel Git Commit 8f6833d, Kernel Git Commit a0724e4, Kernel Git Commit a0f7e80, and Kernel Git Commit e5c9ffc. Apply the version that matches your distribution's kernel branch.

Workarounds

On PowerNV systems missing a power-mgt device tree node, evaluate whether the firmware or device tree can be updated to expose additional idle states.
Consider disabling cpuidle or forcing the menu governor as a temporary measure where supported, after testing for stability impact.
Restrict access to affected hosts until the patched kernel is deployed.

bash

# Verify the running kernel and cpuidle state inventory
uname -r
ls /sys/devices/system/cpu/cpu0/cpuidle/
cat /sys/devices/system/cpu/cpuidle/current_governor_ro