CVE-2026-97905

A flaw was found in the Linux kernel's CPU frequency scaling (cpufreq) subsystem. When creating a frequency policy, the kernel exposes system control files (sysfs attributes) before the CPU mask memory is zero-initialized. A local user could exploit this race condition by accessing these sysfs attributes during CPU initialization, executing operations on an uninitialized policy and causing a system crash, resulting in a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel's CPU frequency scaling (cpufreq) subsystem. When a cpufreq policy is created, the policy's CPU mask (policy->cpus) is allocated without zero-initialization, and the policy's sysfs attributes are published before the mask receives its first valid value. On kernels built with CONFIG_CPUMASK_OFFSTACK=y, a local user who accesses these sysfs attributes during the window between sysfs publication and mask initialization can cause the show()/store() attribute callbacks to execute against an uninitialized policy, which can crash the kernel and result in a local denial of service. Exploitation requires winning a narrow race during CPU online (hotplug) operations, and only system availability is affected; confidentiality and integrity are not. The Red Hat Product Security impact is assessed as low because successful exploitation depends on the timing race and on residual slab contents, limiting the practical consequence to a system crash; this is lower in practice than the CVSS:3.1 base score of 5.5 (moderate) would suggest. Red Hat Enterprise Linux 7, 8, 9, and 10 (including ELS streams and z-stream updates), RHEL In-Vehicle OS 2, and Red Hat OpenShift Container Platform 4 and 5 are affected; the RHEL 6 stream is out of support (OOSS) and no update is planned. Because the impact is low and exploitation requires an unreliable race during CPU hotplug, the fix (zero-initializing the policy cpumask before sysfs publication) is deferred to a future scheduled kernel update for the affected streams; the residual risk is limited to local denial of service through a system crash triggered during CPU onlining.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.