CVE-2025-40194

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: intelpstate: Fix object lifecycle issue in updateqos_request()

The cpufreqcpuput() call in updateqosrequest() takes place too early because the latter subsequently calls freqqosupdate_request() that indirectly accesses the policy object in question through the QoS request object passed to it.

Fortunately, updateqosrequest() is called under intelpstatedriverlock, so this issue does not matter for changing the intelpstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).

Address this issue by modifying updateqosrequest() to drop the reference to the policy later.