CVE-2025-40194

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.

Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).

Address this issue by modifying update_qos_request() to drop the reference to the policy later.

Metrics

No CVSS score has been published yet.

Affected software

VendorProductVersions
LinuxLinux>= da5c504c7aae96db68c4b38e2564a88e91842d89, < 15ac9579ebdaf22a37d7f60b3a8efc1029732ef9; >= da5c504c7aae96db68c4b38e2564a88e91842d89, < bc26564bcc659beb6d977cd6eb394041ec2f2851; >= da5c504c7aae96db68c4b38e2564a88e91842d89, < ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4; >= da5c504c7aae96db68c4b38e2564a88e91842d89, < 0a58d3e77b22b087a57831c87cafd360e144a5bd; >= da5c504c7aae96db68c4b38e2564a88e91842d89, < 69a18ff6c60e8e113420f15355fad862cb45d38e; >= da5c504c7aae96db68c4b38e2564a88e91842d89, < ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3; >= da5c504c7aae96db68c4b38e2564a88e91842d89, < 57e4a6aadf12578b96a038373cffd54b3a58b092; >= da5c504c7aae96db68c4b38e2564a88e91842d89, < 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467
LinuxLinux5.4

References

Timeline

Published
Nov 12, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-40195In the Linux kernel, the following vulnerability has been resolved: mount: handle NULL values in mnt_ns_release() When calling in listmounCVE-2025-40196In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There is CVE-2025-40197In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor shoulCVE-2025-401987.8In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options(CVE-2025-401997.8In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches HCVE-2025-40209.8A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknowCVE-2025-40200In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() SyskalleCVE-2025-402017.8In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sysCVE-2025-402027.8In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of usCVE-2025-402037.8In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage lisCVE-2025-402048.1In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacksCVE-2025-402057.8In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function
CVE-2025-40194: Unscored | Vulnix