AZL-70094
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-70094.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-70094
- Upstream
- Published
- 2025-11-12T22:15:46Z
- Modified
- 2026-04-01T05:21:54Z
- Summary
- CVE-2025-40194 affecting package kernel for versions less than 6.6.117.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.
Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).
Address this issue by modifying update_qos_request() to drop the reference to the policy later.
- References