In the Linux kernel, the following vulnerability has been resolved:
cpufreq: intelpstate: Fix object lifecycle issue in updateqos_request()
The cpufreqcpuput() call in updateqosrequest() takes place too early because the latter subsequently calls freqqosupdate_request() that indirectly accesses the policy object in question through the QoS request object passed to it.
Fortunately, updateqosrequest() is called under intelpstatedriverlock, so this issue does not matter for changing the intelpstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).
Address this issue by modifying updateqosrequest() to drop the reference to the policy later.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a58d3e77b22b087a57831c87cafd360e144a5bd",
"target": {
"function": "update_qos_request",
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-0ab684ad",
"signature_type": "Function",
"digest": {
"function_hash": "119457662066509129953288183687086575406",
"length": 605.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57e4a6aadf12578b96a038373cffd54b3a58b092",
"target": {
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-12bc93a2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335630241271601815990855130545852183244",
"219450750155828161314327751165790699725",
"190898878710075090924364349035586756289",
"184237136360271834811635633868475989090",
"244456800815954262299869681552566382038",
"182256013018351504964724468467884308755",
"234665468252451149332221105363904793127",
"73312607696971659973803704308557393011",
"94030426540397729949637594272579718119",
"236495300679597378224894394426202271943"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69a18ff6c60e8e113420f15355fad862cb45d38e",
"target": {
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-21c997a2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335630241271601815990855130545852183244",
"219450750155828161314327751165790699725",
"190898878710075090924364349035586756289",
"184237136360271834811635633868475989090",
"244456800815954262299869681552566382038",
"182256013018351504964724468467884308755",
"234665468252451149332221105363904793127",
"73312607696971659973803704308557393011",
"94030426540397729949637594272579718119",
"236495300679597378224894394426202271943"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467",
"target": {
"function": "update_qos_request",
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-2da3dc71",
"signature_type": "Function",
"digest": {
"function_hash": "119457662066509129953288183687086575406",
"length": 605.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15ac9579ebdaf22a37d7f60b3a8efc1029732ef9",
"target": {
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-5eb53a8e",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335630241271601815990855130545852183244",
"219450750155828161314327751165790699725",
"190898878710075090924364349035586756289",
"184237136360271834811635633868475989090",
"2206585667016623065589107015734772818",
"306011026996403971341589584720038070248",
"319786977281494511166473940289494250343",
"233362289738890795055646236047590933006",
"94030426540397729949637594272579718119",
"236495300679597378224894394426202271943"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3",
"target": {
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-66a1c9d4",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335630241271601815990855130545852183244",
"219450750155828161314327751165790699725",
"190898878710075090924364349035586756289",
"184237136360271834811635633868475989090",
"244456800815954262299869681552566382038",
"182256013018351504964724468467884308755",
"234665468252451149332221105363904793127",
"73312607696971659973803704308557393011",
"94030426540397729949637594272579718119",
"236495300679597378224894394426202271943"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3",
"target": {
"function": "update_qos_request",
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-8814e7b0",
"signature_type": "Function",
"digest": {
"function_hash": "119457662066509129953288183687086575406",
"length": 605.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc26564bcc659beb6d977cd6eb394041ec2f2851",
"target": {
"function": "update_qos_request",
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-a1027354",
"signature_type": "Function",
"digest": {
"function_hash": "148494335895103245568302736988520386800",
"length": 670.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15ac9579ebdaf22a37d7f60b3a8efc1029732ef9",
"target": {
"function": "update_qos_request",
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-b7ee3e54",
"signature_type": "Function",
"digest": {
"function_hash": "148494335895103245568302736988520386800",
"length": 670.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69a18ff6c60e8e113420f15355fad862cb45d38e",
"target": {
"function": "update_qos_request",
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-be814bfc",
"signature_type": "Function",
"digest": {
"function_hash": "119457662066509129953288183687086575406",
"length": 605.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc26564bcc659beb6d977cd6eb394041ec2f2851",
"target": {
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-e793b8ad",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335630241271601815990855130545852183244",
"219450750155828161314327751165790699725",
"190898878710075090924364349035586756289",
"184237136360271834811635633868475989090",
"36466498346822993052119846717526880603",
"261585388873149107112494643952287792561",
"319786977281494511166473940289494250343",
"233362289738890795055646236047590933006",
"94030426540397729949637594272579718119",
"236495300679597378224894394426202271943"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a58d3e77b22b087a57831c87cafd360e144a5bd",
"target": {
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-ec488bd2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335630241271601815990855130545852183244",
"219450750155828161314327751165790699725",
"190898878710075090924364349035586756289",
"184237136360271834811635633868475989090",
"244456800815954262299869681552566382038",
"182256013018351504964724468467884308755",
"234665468252451149332221105363904793127",
"73312607696971659973803704308557393011",
"94030426540397729949637594272579718119",
"236495300679597378224894394426202271943"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467",
"target": {
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-f19a99bf",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335630241271601815990855130545852183244",
"219450750155828161314327751165790699725",
"190898878710075090924364349035586756289",
"184237136360271834811635633868475989090",
"244456800815954262299869681552566382038",
"182256013018351504964724468467884308755",
"234665468252451149332221105363904793127",
"73312607696971659973803704308557393011",
"94030426540397729949637594272579718119",
"236495300679597378224894394426202271943"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57e4a6aadf12578b96a038373cffd54b3a58b092",
"target": {
"function": "update_qos_request",
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-f7a8ae6c",
"signature_type": "Function",
"digest": {
"function_hash": "119457662066509129953288183687086575406",
"length": 605.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4",
"target": {
"function": "update_qos_request",
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-f9d73dfc",
"signature_type": "Function",
"digest": {
"function_hash": "119457662066509129953288183687086575406",
"length": 605.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4",
"target": {
"file": "drivers/cpufreq/intel_pstate.c"
},
"id": "CVE-2025-40194-fd3f6779",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335630241271601815990855130545852183244",
"219450750155828161314327751165790699725",
"190898878710075090924364349035586756289",
"184237136360271834811635633868475989090",
"244456800815954262299869681552566382038",
"182256013018351504964724468467884308755",
"234665468252451149332221105363904793127",
"73312607696971659973803704308557393011",
"94030426540397729949637594272579718119",
"236495300679597378224894394426202271943"
]
},
"deprecated": false,
"signature_version": "v1"
}
]