CVE-2025-40194
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it. Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless). Address this issue by modifying update_qos_request() to drop the reference to the policy later.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-11-12 22:15:46.427000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-40194",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-11-12T22:15:46.427",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()\n\nThe cpufreq_cpu_put() call in update_qos_request() takes place too early\nbecause the latter subsequently calls freq_qos_update_request() that\nindirectly accesses the policy object in question through the QoS request\nobject passed to it.\n\nFortunately, update_qos_request() is called under intel_pstate_driver_lock,\nso this issue does not matter for changing the intel_pstate operation\nmode, but it theoretically can cause a crash to occur on CPU device hot\nremoval (which currently can only happen in virt, but it is formally\nsupported nevertheless).\n\nAddress this issue by modifying update_qos_request() to drop the\nreference to the policy later."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncpufreq: intel_pstate: Corrección de un problema de ciclo de vida del objeto en update_qos_request()\n\nLa llamada a cpufreq_cpu_put() en update_qos_request() tiene lugar demasiado pronto porque esta última posteriormente llama a freq_qos_update_request() que accede indirectamente al objeto de política en cuestión a través del objeto de solicitud de QoS que se le pasa.\n\nAfortunadamente, update_qos_request() es llamada bajo intel_pstate_driver_lock, por lo que este problema no importa para cambiar el modo de operación de intel_pstate, pero teóricamente puede causar un fallo en la extracción en caliente de un dispositivo de CPU (lo cual actualmente solo puede ocurrir en entornos virtuales, pero está formalmente soportado de todos modos).\n\nSe aborda este problema modificando update_qos_request() para liberar la referencia a la política más tarde."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/cpufreq/intel_pstate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
"lessThan": "15ac9579ebdaf22a37d7f60b3a8efc1029732ef9",
"versionType": "git",
"status": "affected"
},
{
"version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
"lessThan": "bc26564bcc659beb6d977cd6eb394041ec2f2851",
"versionType": "git",
"status": "affected"
},
{
"version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
"lessThan": "ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4",
"versionType": "git",
"status": "affected"
},
{
"version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
"lessThan": "0a58d3e77b22b087a57831c87cafd360e144a5bd",
"versionType": "git",
"status": "affected"
},
{
"version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
"lessThan": "69a18ff6c60e8e113420f15355fad862cb45d38e",
"versionType": "git",
"status": "affected"
},
{
"version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
"lessThan": "ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3",
"versionType": "git",
"status": "affected"
},
{
"version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
"lessThan": "57e4a6aadf12578b96a038373cffd54b3a58b092",
"versionType": "git",
"status": "affected"
},
{
"version": "da5c504c7aae96db68c4b38e2564a88e91842d89",
"lessThan": "69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/cpufreq/intel_pstate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.4",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.4",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.301",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.246",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.195",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.157",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.113",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.54",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.4",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a58d3e77b22b087a57831c87cafd360e144a5bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/15ac9579ebdaf22a37d7f60b3a8efc1029732ef9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/57e4a6aadf12578b96a038373cffd54b3a58b092",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/69a18ff6c60e8e113420f15355fad862cb45d38e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bc26564bcc659beb6d977cd6eb394041ec2f2851",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}