CVE-2025-40194

cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

State: Published
Severity: Not scored
Published: Nov 12, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.

Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).

Address this issue by modifying update_qos_request() to drop the reference to the policy later.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	da5c504c7aae96db68c4b38e2564a88e91842d89 to before 15ac9579ebdaf22a37d7f60b3a8efc1029732ef9Affected da5c504c7aae96db68c4b38e2564a88e91842d89 to before bc26564bcc659beb6d977cd6eb394041ec2f2851Affected da5c504c7aae96db68c4b38e2564a88e91842d89 to before ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4Affected da5c504c7aae96db68c4b38e2564a88e91842d89 to before 0a58d3e77b22b087a57831c87cafd360e144a5bdAffected da5c504c7aae96db68c4b38e2564a88e91842d89 to before 69a18ff6c60e8e113420f15355fad862cb45d38eAffected da5c504c7aae96db68c4b38e2564a88e91842d89 to before ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3Affected da5c504c7aae96db68c4b38e2564a88e91842d89 to before 57e4a6aadf12578b96a038373cffd54b3a58b092Affected da5c504c7aae96db68c4b38e2564a88e91842d89 to before 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467Affected
LinuxLinux	5.4Affected before 5.4Not affected 5.4.301 through 5.4.Not affected 5.10.246 through 5.10.Not affected 5.15.195 through 5.15.Not affected 6.1.157 through 6.1.Not affected 6.6.113 through 6.6.Not affected 6.12.54 through 6.12.Not affected 6.17.4 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

da5c504c7aae96db68c4b38e2564a88e91842d89 to before 15ac9579ebdaf22a37d7f60b3a8efc1029732ef9Affected
da5c504c7aae96db68c4b38e2564a88e91842d89 to before bc26564bcc659beb6d977cd6eb394041ec2f2851Affected
da5c504c7aae96db68c4b38e2564a88e91842d89 to before ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4Affected
da5c504c7aae96db68c4b38e2564a88e91842d89 to before 0a58d3e77b22b087a57831c87cafd360e144a5bdAffected
da5c504c7aae96db68c4b38e2564a88e91842d89 to before 69a18ff6c60e8e113420f15355fad862cb45d38eAffected
da5c504c7aae96db68c4b38e2564a88e91842d89 to before ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3Affected
da5c504c7aae96db68c4b38e2564a88e91842d89 to before 57e4a6aadf12578b96a038373cffd54b3a58b092Affected
da5c504c7aae96db68c4b38e2564a88e91842d89 to before 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467Affected

LinuxLinux

5.4Affected
before 5.4Not affected
5.4.301 through 5.4.*Not affected
5.10.246 through 5.10.*Not affected
5.15.195 through 5.15.*Not affected
6.1.157 through 6.1.*Not affected
6.6.113 through 6.6.*Not affected
6.12.54 through 6.12.*Not affected
6.17.4 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.