CVE-2026-97904cpufreq: initialize policy rwsem before sysfs publication
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreq_policy_alloc() initializes policy->rwsem after kobject_init_and_add() has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a policy callback before the semaphore has been initialized. Initialize policy->rwsem before publishing the policy kobject so sysfs callbacks always see an initialized semaphore.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before c9d8435814f2ac533c40fe3f35d94235bc3a9443; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before 82a54923700da5de83ce2b26c0b43f6b5005c8f1; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before b14987a0f73777644099f47f01aba3b0f9dc6c27; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4a; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before dc11263cb05ed519758fd135fe08d611bad1f241; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before 27c9b491bf7604e83b50c3bbfa18a30266ff345f; 2fc3384dc75bf7333384c7a16d12c796f61c3f56 builds before 2cee937f779f69b195b37bbec1e888da9bfe9d58; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before 3e5d1bf4bd687beb2cb4e32a07af695455925588 | CNA record |
References
- https://git.kernel.org/stable/c/c9d8435814f2ac533c40fe3f35d94235bc3a9443
- https://git.kernel.org/stable/c/82a54923700da5de83ce2b26c0b43f6b5005c8f1
- https://git.kernel.org/stable/c/b14987a0f73777644099f47f01aba3b0f9dc6c27
- https://git.kernel.org/stable/c/b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4a
- https://git.kernel.org/stable/c/dc11263cb05ed519758fd135fe08d611bad1f241
- https://git.kernel.org/stable/c/27c9b491bf7604e83b50c3bbfa18a30266ff345f
- https://git.kernel.org/stable/c/2cee937f779f69b195b37bbec1e888da9bfe9d58
- https://git.kernel.org/stable/c/3e5d1bf4bd687beb2cb4e32a07af695455925588
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.