CVE-2026-97904

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97904
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-97904.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-97904
Downstream
Related
Published
2026-09-25T10:22:30Z
Modified
2026-10-09T17:26:58Z
Summary
cpufreq: initialize policy rwsem before sysfs publication
Details

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: initialize policy rwsem before sysfs publication

cpufreq_policy_alloc() initializes policy->rwsem after kobject_init_and_add() has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a policy callback before the semaphore has been initialized.

Initialize policy->rwsem before publishing the policy kobject so sysfs callbacks always see an initialized semaphore.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97904.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2fc3384dc75bf7333384c7a16d12c796f61c3f56
Fixed
c9d8435814f2ac533c40fe3f35d94235bc3a9443
Fixed
82a54923700da5de83ce2b26c0b43f6b5005c8f1
Fixed
b14987a0f73777644099f47f01aba3b0f9dc6c27
Fixed
b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4a
Fixed
dc11263cb05ed519758fd135fe08d611bad1f241
Fixed
27c9b491bf7604e83b50c3bbfa18a30266ff345f
Fixed
2cee937f779f69b195b37bbec1e888da9bfe9d58
Fixed
3e5d1bf4bd687beb2cb4e32a07af695455925588

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-97904.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
5.10.271
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.111
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-97904.json"