SB20260928301 - Use of uninitialized resource in Linux kernel cpufreq driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-97905)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invoke sysfs attribute callbacks on an uninitialized cpufreq policy.

The vulnerability exists due to use of uninitialized memory in the policy->cpus cpumask in cpufreq_policy_alloc() when a cpufreq policy is published to sysfs before initialization completes. A local user can access sysfs attributes during this initialization window to invoke callbacks on the uninitialized policy.

Only systems configured with CONFIG_CPUMASK_OFFSTACK=y are affected by the uninitialized separately allocated bitmap.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0de2f3918fbbbb767e7e716178194b66560dd12a
• https://git.kernel.org/stable/c/54d37bcf2f497140b9207968557ddb484058e749
• https://git.kernel.org/stable/c/6e166b9281dec98aed19213a84235250e5fdb081
• https://git.kernel.org/stable/c/bbc0472d2270bf732142ca71579d6ede636174ed