CVE-2026-89572: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89572 Overview

CVE-2026-89572 is a resource management flaw in the Linux kernel's Apple SoC cpufreq driver. The apple_soc_cpufreq_init() function loads Operating Performance Points (OPP) tables from firmware but fails to remove them on several error paths. The driver also calls dev_pm_opp_remove_all_dynamic(), which is not the correct cleanup helper for OPP tables loaded from firmware. This mismatch produces a memory leak and inconsistent driver state on Apple silicon systems running Linux.

Critical Impact
Repeated driver initialization failures or module reload cycles can leak kernel OPP table resources on Apple SoC hardware, degrading system stability over time.

Affected Products

Linux kernel cpufreq subsystem, Apple SoC driver (apple-soc-cpufreq)
Linux distributions running on Apple silicon platforms
Stable kernel branches referenced by upstream commits 36c55d1, 7c19b94, and d87cb88

Discovery Timeline

2026-09-11 - CVE-2026-89572 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89572

Vulnerability Analysis

The Apple SoC cpufreq driver registers OPP tables sourced from device firmware during apple_soc_cpufreq_init(). When initialization fails after the OPP tables are added, several return paths exit without removing the registered tables. The driver additionally invokes dev_pm_opp_remove_all_dynamic() for teardown, which targets dynamically added OPPs rather than tables loaded from firmware or Device Tree. The mismatch leaves stale OPP references attached to the CPU device.

The fix replaces the incorrect teardown helper with the cpumask-based OPP helper after the policy CPU mask is populated. The matching cpumask remove helper is invoked on failure paths and in apple_soc_cpufreq_exit(). This change also removes the separate dev_pm_opp_set_sharing_cpus() call, because the cpumask helper handles OPP loading for all CPUs in the policy.

Root Cause

The root cause is improper resource cleanup in a kernel driver initialization routine. Error paths in apple_soc_cpufreq_init() skip OPP table removal, and the wrong removal helper is used elsewhere. This is a resource management bug affecting the Power Management OPP framework interactions.

Attack Vector

The issue is triggered by driver initialization failures on Apple SoC systems, not by a remote or unauthenticated attacker. Repeated cpufreq driver load and unload cycles, or hardware conditions that cause init to fail, exercise the faulty error paths and leak kernel resources. Exploitation for privilege escalation has not been demonstrated in the referenced commits.

The vulnerability is a kernel-side reliability defect. Consult the upstream fix commits for exact line-level changes.

Detection Methods for CVE-2026-89572

Indicators of Compromise

Kernel log entries indicating repeated apple-soc-cpufreq probe or init failures
Growth in kernel memory attributable to OPP table structures over time
Warnings from the OPP framework about duplicate or stale OPP entries on the CPU device

Detection Strategies

Inventory Linux systems running on Apple silicon and compare running kernel versions against the patched stable branches
Monitor dmesg output for cpufreq and opp subsystem errors after boot and after suspend or resume cycles
Track kernel memory usage trends on affected hosts to identify slow leaks tied to driver reinitialization

Monitoring Recommendations

Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) in test environments to validate patch application
Aggregate host telemetry into a centralized data lake for longitudinal analysis of kernel warnings and memory metrics
Alert on unexpected cpufreq driver rebind events, which may indicate underlying hardware or firmware issues that exercise the buggy code path

How to Mitigate CVE-2026-89572

Immediate Actions Required

Apply the upstream stable kernel updates referenced by commits 36c55d1, 7c19b94, and d87cb88
Rebuild or upgrade distribution kernels for Apple silicon hosts to include the OPP cleanup fix
Reboot affected systems after patch deployment to load the corrected driver

Patch Information

The fix is available in the Linux stable tree via the following commits: Kernel Git Commit 36c55d1, Kernel Git Commit 7c19b94, and Kernel Git Commit d87cb88. The patches switch to the cpumask OPP helper and pair it with the matching remove helper on failure paths and in apple_soc_cpufreq_exit().

Workarounds

Avoid repeated unload and reload of the apple-soc-cpufreq module on unpatched systems
Where feasible, restrict test workflows that stress cpufreq driver initialization until the patched kernel is deployed
Schedule periodic reboots for long-running unpatched Apple silicon Linux hosts to reset leaked kernel state

bash

# Verify running kernel version and confirm the fix is present
uname -r
git log --oneline -1 36c55d118d5ecd2fb444f52802955903937b9ccd