CVE-2026-97904

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: initialize policy rwsem before sysfs publication

cpufreq policy alloc() initializes policy->rwsem after kobject init and add() has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a policy callback before the semaphore has been initialized.

Initialize policy->rwsem before publishing the policy kobject so sysfs callbacks always see an initialized semaphore.