« Volver al listado

CVE-2025-40194

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.

Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).

Leer descripción completaMostrar menos

Address this issue by modifying update_qos_request() to drop the reference to the policy later.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-40194",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
              "lessThan": "15ac9579ebdaf22a37d7f60b3a8efc1029732ef9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
              "lessThan": "bc26564bcc659beb6d977cd6eb394041ec2f2851",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
              "lessThan": "ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
              "lessThan": "0a58d3e77b22b087a57831c87cafd360e144a5bd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
              "lessThan": "69a18ff6c60e8e113420f15355fad862cb45d38e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
              "lessThan": "ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
              "lessThan": "57e4a6aadf12578b96a038373cffd54b3a58b092",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
              "lessThan": "69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/cpufreq/intel_pstate.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/cpufreq/intel_pstate.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-11-12T22:15:46.427",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0a58d3e77b22b087a57831c87cafd360e144a5bd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/15ac9579ebdaf22a37d7f60b3a8efc1029732ef9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/57e4a6aadf12578b96a038373cffd54b3a58b092",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/69a18ff6c60e8e113420f15355fad862cb45d38e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bc26564bcc659beb6d977cd6eb394041ec2f2851",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()\n\nThe cpufreq_cpu_put() call in update_qos_request() takes place too early\nbecause the latter subsequently calls freq_qos_update_request() that\nindirectly accesses the policy object in question through the QoS request\nobject passed to it.\n\nFortunately, update_qos_request() is called under intel_pstate_driver_lock,\nso this issue does not matter for changing the intel_pstate operation\nmode, but it theoretically can cause a crash to occur on CPU device hot\nremoval (which currently can only happen in virt, but it is formally\nsupported nevertheless).\n\nAddress this issue by modifying update_qos_request() to drop the\nreference to the policy later."
    }
  ],
  "lastModified": "2026-06-17T09:21:26.297",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}