Not yet scoredPublished Sep 25, 2026

CVE-2026-97904cpufreq: initialize policy rwsem before sysfs publication

Updated under an hour ago (Oct 26, 2026, 7:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreq_policy_alloc() initializes policy->rwsem after kobject_init_and_add() has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a policy callback before the semaphore has been initialized. Initialize policy->rwsem before publishing the policy kobject so sysfs callbacks always see an initialized semaphore.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before c9d8435814f2ac533c40fe3f35d94235bc3a9443; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before 82a54923700da5de83ce2b26c0b43f6b5005c8f1; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before b14987a0f73777644099f47f01aba3b0f9dc6c27; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4a; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before dc11263cb05ed519758fd135fe08d611bad1f241; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before 27c9b491bf7604e83b50c3bbfa18a30266ff345f; 2fc3384dc75bf7333384c7a16d12c796f61c3f56 builds before 2cee937f779f69b195b37bbec1e888da9bfe9d58; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56 before 3e5d1bf4bd687beb2cb4e32a07af695455925588	CNA record

References

References

https://git.kernel.org/stable/c/c9d8435814f2ac533c40fe3f35d94235bc3a9443
https://git.kernel.org/stable/c/82a54923700da5de83ce2b26c0b43f6b5005c8f1
https://git.kernel.org/stable/c/b14987a0f73777644099f47f01aba3b0f9dc6c27
https://git.kernel.org/stable/c/b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4a
https://git.kernel.org/stable/c/dc11263cb05ed519758fd135fe08d611bad1f241
https://git.kernel.org/stable/c/27c9b491bf7604e83b50c3bbfa18a30266ff345f
https://git.kernel.org/stable/c/2cee937f779f69b195b37bbec1e888da9bfe9d58
https://git.kernel.org/stable/c/3e5d1bf4bd687beb2cb4e32a07af695455925588

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.