CVE-2026-64373 Overview
CVE-2026-64373 is a race condition vulnerability in the Linux kernel's cpufreq subsystem. The flaw occurs during system reboot when cpufreq_suspend() runs concurrently with CPU hotplug operations. Unlike the standard suspend path, the reboot path does not invoke freeze_processes(), leaving userspace processes and kernel threads active. This allows the hotplug path to free governor_data while cpufreq_suspend() still holds a reference, producing a null pointer dereference in kernel context. The result is a kernel crash during the reboot sequence, affecting system availability and reliability.
Critical Impact
Concurrent CPU hotplug and cpufreq_suspend() execution during reboot triggers a null pointer dereference in the Linux kernel, causing a kernel oops and denial of service.
Affected Products
- Linux kernel (upstream) — versions prior to the fix commits referenced in stable/c/ trees
- Linux distributions shipping vulnerable stable kernel branches
- Systems using the cpufreq subsystem with dynamic CPU hotplug support
Discovery Timeline
- 2026-07-25 - CVE-2026-64373 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64373
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] between CPU hotplug operations and the cpufreq_suspend() function during system reboot. When a user issues a reboot, the kernel executes kernel_restart(), which calls device_shutdown(), which in turn calls cpufreq_suspend(). In the normal suspend flow, freeze_processes() quiesces userspace and kernel threads before device suspend runs. The reboot path skips this freeze step, so other threads continue to run.
With threads still active, a CPU hotplug operation can execute in parallel with cpufreq_suspend(). The hotplug path can free the governor_data structure while cpufreq_suspend() is dereferencing it. The kernel then attempts to access freed memory through a null pointer, generating the fault shown in the reported call trace: do_kernel_fault → cpufreq_suspend → device_shutdown → kernel_restart → arm64_sys_reboot.
Root Cause
The root cause is missing synchronization between cpufreq_suspend() and the CPU hotplug subsystem. The original implementation did not hold any hotplug lock while iterating cpufreq policy data, allowing a concurrent hotplug removal to invalidate the governor_data pointer. The upstream fix wraps cpufreq_suspend() with cpus_read_lock() and cpus_read_unlock(), blocking CPU hotplug operations for the duration of suspend processing.
Attack Vector
Exploitation requires local access sufficient to trigger a reboot and to induce CPU hotplug activity. An unprivileged local user cannot typically initiate reboot on hardened systems, but administrative or automation workflows on multi-tenant hosts, embedded systems, and ARM64 platforms can encounter the race under normal operational conditions. The immediate consequence is a kernel null pointer dereference producing a system crash rather than code execution or privilege escalation. Reliability, not confidentiality or integrity, is the primary concern.
See the upstream commits for the exact patch content: kernel.org commit 6d5dd354c37a and kernel.org commit a0106b41f9a7.
Detection Methods for CVE-2026-64373
Indicators of Compromise
- Kernel oops messages referencing cpufreq_suspend+0xdc/0x160 in the call trace during reboot
- Unable to handle kernel NULL pointer dereference fault entries in dmesg or persistent kernel logs
- Reboot cycles that hang or produce panic messages on ARM64 systems using cpufreq governors
Detection Strategies
- Parse journalctl -k and /var/log/kern.log for null pointer dereferences with cpufreq_suspend frames.
- Monitor for unexpected reboot loops or failed shutdown transitions on fleet endpoints.
- Track running kernel versions against the fixed commits published in the stable trees.
Monitoring Recommendations
- Ingest kernel crash logs and kdump output into a centralized logging platform for pattern matching.
- Alert on kernel panics containing device_shutdown and cpufreq_suspend frames in the same stack.
- Track kernel package versions across Linux endpoints and flag hosts still running unpatched builds.
How to Mitigate CVE-2026-64373
Immediate Actions Required
- Apply the upstream Linux kernel patches that add cpus_read_lock()/cpus_read_unlock() around cpufreq_suspend().
- Update to distribution kernel packages that incorporate the referenced stable commits.
- Reboot affected systems into the patched kernel after installation.
Patch Information
The fix has been merged across multiple stable branches. Reference commits include 6d5dd354c37a, 6e175c00c62d, 73255d702c75, 9103078c7b30, a0106b41f9a7, a0ef2fc89d28, a9029dd55696, and cd4524ff6567. Consult your Linux distribution advisories for the specific package version containing the backport.
Workarounds
- Avoid triggering CPU hotplug operations during shutdown or reboot workflows.
- Disable dynamic CPU hotplug on production reboot windows where operationally feasible.
- Use scheduled maintenance windows to reduce concurrent hotplug activity during system restart.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
