{"id":"CVE-2026-97905","revision":"cd87e9df72d14597ab6ee8d4d1579d03","records":[{"revision":"cd87e9df72d14597ab6ee8d4d1579d03","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97905","aliases":[],"title":"cpufreq: zero-initialize policy cpumask before sysfs publication","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: zero-initialize policy cpumask before sysfs publication\n\ncpufreq_policy_alloc() allocates policy->cpus with alloc_cpumask_var(),\ni.e. without __GFP_ZERO, unlike the sibling related_cpus and real_cpus\nmasks. With CONFIG_CPUMASK_OFFSTACK=y the mask is a separate\nkmalloc_node() allocation, so its bitmap holds whatever the slab allocator\nleft behind:\n\n  cpufreq_online()\n    cpufreq_policy_alloc()\n      alloc_cpumask_var(&policy->cpus)    /* bitmap is uninitialized */\n      kobject_init_and_add()              /* policy%u/ appears in sysfs */\n    cpufreq_policy_online()\n      cpumask_copy(policy->cpus, cpumask_of(cpu))  /* first valid value */\n\nThis leaves a window in which the sysfs attributes are already reachable\nwhile policy->cpus is still garbage. show()/store() gate on\npolicy_is_inactive(), i.e. cpumask_empty(policy->cpus), so a non-zero\nbitmap makes them run the attribute callbacks on a policy that is not\ninitialized yet.\n\nFix this by using zalloc_cpumask_var() for policy->cpus.","state":0,"publishedAt":"2026-09-25T10:22:31.046+00:00","modifiedAt":"2026-10-19T09:10:31.498+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/cpufreq/cpufreq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2fc3384dc75bf7333384c7a16d12c796f61c3f56\",\n                            \"lessThan\": \"e13370c5b549712f49f80234df249303381c53b4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fc3384dc75bf7333384c7a16d12c796f61c3f56\",\n                            \"lessThan\": \"e807920031ca32b668f9e7a1efbd21858f03d64b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fc3384dc75bf7333384c7a16d12c796f61c3f56\",\n                            \"lessThan\": \"ca52482508b3ac9febe74ca4f732647d394727b8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fc3384dc75bf7333384c7a16d12c796f61c3f56\",\n                            \"lessThan\": \"06f273d29e5e0fe5c775a65c563fbeed8cd94c7a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fc3384dc75bf7333384c7a16d12c796f61c3f56\",\n                            \"lessThan\": \"0de2f3918fbbbb767e7e716178194b66560dd12a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fc3384dc75bf7333384c7a16d12c796f61c3f56\",\n                            \"lessThan\": \"6e166b9281dec98aed19213a84235250e5fdb081\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fc3384dc75bf7333384c7a16d12c796f61c3f56\",\n                            \"lessThan\": \"bbc0472d2270bf732142ca71579d6ede636174ed\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fc3384dc75bf7333384c7a16d12c796f61c3f56\",\n                            \"lessThan\": \"54d37bcf2f497140b9207968557ddb484058e749\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/cpufreq/cpufreq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e13370c5b549712f49f80234df249303381c53b4","https://git.kernel.org/stable/c/e807920031ca32b668f9e7a1efbd21858f03d64b","https://git.kernel.org/stable/c/ca52482508b3ac9febe74ca4f732647d394727b8","https://git.kernel.org/stable/c/06f273d29e5e0fe5c775a65c563fbeed8cd94c7a","https://git.kernel.org/stable/c/0de2f3918fbbbb767e7e716178194b66560dd12a","https://git.kernel.org/stable/c/6e166b9281dec98aed19213a84235250e5fdb081","https://git.kernel.org/stable/c/bbc0472d2270bf732142ca71579d6ede636174ed","https://git.kernel.org/stable/c/54d37bcf2f497140b9207968557ddb484058e749"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97905","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97905","identifiers":["CVE-2026-97905"]},"retained":false,"historicalAffected":[]}],"coverage":[]}