Medium 5.5Published May 27, 2026

CVE-2026-45968cpuidle: Skip governor when only one idle state is available

Updated under an hour ago (Oct 26, 2026, 3:23 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: cpuidle: Skip governor when only one idle state is available On certain platforms (PowerNV systems without a power-mgt DT node), cpuidle may register only a single idle state. In cases where that single state is a polling state (state 0), the ladder governor may incorrectly treat state 1 as the first usable state and pass an out-of-bounds index. This can lead to a NULL enter callback being invoked, ultimately resulting in a system crash. [ 13.342636] cpuidle-powernv : Only Snooze is available [ 13.351854] Faulting instruction address: 0x00000000 [ 13.376489] NIP [0000000000000000] 0x0 [ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668 Fix this by adding a bail-out in cpuidle_select() that returns state 0 directly when state_count <= 1, bypassing the governor and keeping the tick running.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from dc2251bf98c66db3f4e055b751968f0871037ae4 before a0f7e804edc82e513d1ccb7c95ed8b351522ec81; from dc2251bf98c66db3f4e055b751968f0871037ae4 before 5d103a38e2ae96eca57fd17161bcd29bd4622d1c; from dc2251bf98c66db3f4e055b751968f0871037ae4 before 4da2b897283c39980d6ae09dc1560fcd937879e5; from dc2251bf98c66db3f4e055b751968f0871037ae4 before 5c577ac939bca486cb02069505cfe47a5312ce02; from dc2251bf98c66db3f4e055b751968f0871037ae4 before 8f6833d919bae915ead6c599a53e81e19b32da52; from dc2251bf98c66db3f4e055b751968f0871037ae4 before 63ae78336f40bcd9a44952a7c6bafb9c88a8effd; from dc2251bf98c66db3f4e055b751968f0871037ae4 before a0724e40a58a0e323c59707edeae5b71d15800dc; from dc2251bf98c66db3f4e055b751968f0871037ae4 before e5c9ffc6ae1bcdb1062527d611043681ac301aca	CNA record
linux linux_kernel linux:linux_kernel	from 4.14 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4	NVD

References

References

https://git.kernel.org/stable/c/a0f7e804edc82e513d1ccb7c95ed8b351522ec81	patch
https://git.kernel.org/stable/c/5d103a38e2ae96eca57fd17161bcd29bd4622d1c	patch
https://git.kernel.org/stable/c/4da2b897283c39980d6ae09dc1560fcd937879e5	patch
https://git.kernel.org/stable/c/5c577ac939bca486cb02069505cfe47a5312ce02	patch
https://git.kernel.org/stable/c/8f6833d919bae915ead6c599a53e81e19b32da52	patch
https://git.kernel.org/stable/c/63ae78336f40bcd9a44952a7c6bafb9c88a8effd	patch
https://git.kernel.org/stable/c/a0724e40a58a0e323c59707edeae5b71d15800dc	patch
https://git.kernel.org/stable/c/e5c9ffc6ae1bcdb1062527d611043681ac301aca	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.