{"id":"CVE-2026-97905","summary":"cpufreq: zero-initialize policy cpumask before sysfs publication","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: zero-initialize policy cpumask before sysfs publication\n\ncpufreq_policy_alloc() allocates policy-\u003ecpus with alloc_cpumask_var(),\ni.e. without __GFP_ZERO, unlike the sibling related_cpus and real_cpus\nmasks. With CONFIG_CPUMASK_OFFSTACK=y the mask is a separate\nkmalloc_node() allocation, so its bitmap holds whatever the slab allocator\nleft behind:\n\n  cpufreq_online()\n    cpufreq_policy_alloc()\n      alloc_cpumask_var(&policy-\u003ecpus)    /* bitmap is uninitialized */\n      kobject_init_and_add()              /* policy%u/ appears in sysfs */\n    cpufreq_policy_online()\n      cpumask_copy(policy-\u003ecpus, cpumask_of(cpu))  /* first valid value */\n\nThis leaves a window in which the sysfs attributes are already reachable\nwhile policy-\u003ecpus is still garbage. show()/store() gate on\npolicy_is_inactive(), i.e. cpumask_empty(policy-\u003ecpus), so a non-zero\nbitmap makes them run the attribute callbacks on a policy that is not\ninitialized yet.\n\nFix this by using zalloc_cpumask_var() for policy-\u003ecpus.","modified":"2026-09-27T03:47:31.980680115Z","published":"2026-09-25T10:22:31.046Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97905.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0de2f3918fbbbb767e7e716178194b66560dd12a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/54d37bcf2f497140b9207968557ddb484058e749"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6e166b9281dec98aed19213a84235250e5fdb081"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bbc0472d2270bf732142ca71579d6ede636174ed"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97905.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97905"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2fc3384dc75bf7333384c7a16d12c796f61c3f56"},{"fixed":"0de2f3918fbbbb767e7e716178194b66560dd12a"},{"fixed":"6e166b9281dec98aed19213a84235250e5fdb081"},{"fixed":"bbc0472d2270bf732142ca71579d6ede636174ed"},{"fixed":"54d37bcf2f497140b9207968557ddb484058e749"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97905.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97905.json"}}],"schema_version":"1.9.0"}