CVE-2026-23332

A flaw was found in the Linux kernel's intel_pstate cpufreq driver. A local user can trigger a system crash, leading to a Denial of Service (DoS), by attempting to disable the CPU turbo feature through the sysfs interface. This vulnerability occurs on systems booted with specific kernel arguments like "nosmt" or "maxcpus", due to a NULL pointer dereference when processing offline CPUs.

This flaw affects Intel systems using the intel_pstate cpufreq driver when booted with nosmt or maxcpus boot parameters. Writing to /sys/devices/system/cpu/intel_pstate/no_turbo causes all_cpu_data[] to be dereferenced for offline CPUs, which have NULL entries. The crash requires sysfs write access, typically requiring root privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid modifying /sys/devices/system/cpu/intel_pstate/no_turbo on systems booted with nosmt or maxcpus parameters.