Bug 2414739 (CVE-2025-40194)

Summary: CVE-2025-40194 kernel: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Intel P-state driver (intel_pstate) in the Linux kernel. In the function update_qos_request(), a cpufreq_cpu_put() call happens too early, which is followed by freq_qos_update_request() that may still access the previously freed policy object. A race or object-lifecycle error on CPU hot removal (currently possible in virtualised environments) could lead to a crash (denial of service).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-11-12 23:03:40 UTC 
In the Linux kernel, the following vulnerability has been resolved:

cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

The cpufreq_cpu_put() call in update_qos_request() takes place too early
because the latter subsequently calls freq_qos_update_request() that
indirectly accesses the policy object in question through the QoS request
object passed to it.

Fortunately, update_qos_request() is called under intel_pstate_driver_lock,
so this issue does not matter for changing the intel_pstate operation
mode, but it theoretically can cause a crash to occur on CPU device hot
removal (which currently can only happen in virt, but it is formally
supported nevertheless).

Address this issue by modifying update_qos_request() to drop the
reference to the policy later.
Comment 1 Alexander B 2025-11-13 10:42:52 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025111245-CVE-2025-40194-d959@gregkh/T