CVE-2022-50473

An initialization order bug was found in the Linux kernel's cpufreq subsystem during policy allocation. A local user can trigger this issue when CPU frequency policy initialization fails after kobject registration but before completion initialization, causing the cleanup path to attempt to use an uninitialized completion variable. This results in a page fault and kernel crash, leading to denial of service.

The cpufreq_policy_alloc function creates CPU frequency policy objects and registers them with the sysfs kobject infrastructure. During this process, a completion variable is used for synchronization when the policy object is eventually released. The problem is timing: kobject_init_and_add can fail, triggering an error cleanup path that calls kobject_put. This leads to cpufreq_sysfs_release being invoked, which tries to complete on the completion variable—but that variable hasn't been initialized yet because init_completion is called after the kobject registration. Accessing an uninitialized completion causes the kernel to dereference invalid memory (specifically address 0xfffffffffffffff8), resulting in an immediate page fault and crash. This can happen during normal CPU frequency driver initialization when any of various failure conditions occur, such as memory allocation failures or sysfs registration conflicts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.