CVE-2026-64373

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists during system reboot when cpufreq suspend() is called via the kernel restart() to device shutdown() path. Because the reboot path does not call freeze processes(), userspace processes and kernel threads remain active, allowing CPU hotplug operations to run concurrently with cpufreq suspend(). Due to a lack of synchronization, the governor data variable can be freed by the hotplug path while cpufreq suspend() is still accessing it, leading to a null pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.