CVE-2026-97904

cpufreq: initialize policy rwsem before sysfs publication

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: initialize policy rwsem before sysfs publication

cpufreq_policy_alloc() initializes policy->rwsem after kobject_init_and_add() has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a policy callback before the semaphore has been initialized.

Initialize policy->rwsem before publishing the policy kobject so sysfs callbacks always see an initialized semaphore.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before c9d8435814f2ac533c40fe3f35d94235bc3a9443Affected 2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before 82a54923700da5de83ce2b26c0b43f6b5005c8f1Affected 2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before b14987a0f73777644099f47f01aba3b0f9dc6c27Affected 2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4aAffected 2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before dc11263cb05ed519758fd135fe08d611bad1f241Affected 2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before 27c9b491bf7604e83b50c3bbfa18a30266ff345fAffected 2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before 2cee937f779f69b195b37bbec1e888da9bfe9d58Affected 2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before 3e5d1bf4bd687beb2cb4e32a07af695455925588Affected
LinuxLinux	4.2Affected before 4.2Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before c9d8435814f2ac533c40fe3f35d94235bc3a9443Affected
2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before 82a54923700da5de83ce2b26c0b43f6b5005c8f1Affected
2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before b14987a0f73777644099f47f01aba3b0f9dc6c27Affected
2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4aAffected
2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before dc11263cb05ed519758fd135fe08d611bad1f241Affected
2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before 27c9b491bf7604e83b50c3bbfa18a30266ff345fAffected
2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before 2cee937f779f69b195b37bbec1e888da9bfe9d58Affected
2fc3384dc75bf7333384c7a16d12c796f61c3f56 to before 3e5d1bf4bd687beb2cb4e32a07af695455925588Affected

LinuxLinux

4.2Affected
before 4.2Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.