CVE-2026-45968

cpuidle: Skip governor when only one idle state is available

Published May 27, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

cpuidle: Skip governor when only one idle state is available

On certain platforms (PowerNV systems without a power-mgt DT node),
cpuidle may register only a single idle state. In cases where that
single state is a polling state (state 0), the ladder governor may
incorrectly treat state 1 as the first usable state and pass an
out-of-bounds index. This can lead to a NULL enter callback being
invoked, ultimately resulting in a system crash.

[ 13.342636] cpuidle-powernv : Only Snooze is available
[ 13.351854] Faulting instruction address: 0x00000000
[ 13.376489] NIP [0000000000000000] 0x0
[ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668

Fix this by adding a bail-out in cpuidle_select() that returns state 0
directly when state_count <= 1, bypassing the governor and keeping the
tick running.

Analysis

Technical impact

The bug occurs in the Linux kernel’s cpuidle subsystem when only one idle state is registered, typically the polling state (state 0). The ladder governor mistakenly treats a nonexistent state 1 as the first usable state, causing an out‑of‑bounds index and a NULL enter callback. This leads to a kernel panic, a classic denial‑of‑service scenario. The flaw manifests as a null pointer dereference (CWE‑476).

Affected Systems

All Linux kernel builds running on platforms that expose just a single idle state, such as PowerNV systems without a power‑management device tree node, are affected. The vulnerability exists in any kernel that has not incorporated the recent bail‑out in cpuidle_select for state_count <= 1.

Risk and Exploitability

Based on the description, it is inferred that the attack vector is local; an attacker with physical or local access who can force a one‑state configuration or boot the affected hardware will cause an immediate system crash. The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. No public exploits have been reported.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< a0f7e804edc82e513d1ccb7c95ed8b351522ec81
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 5d103a38e2ae96eca57fd17161bcd29bd4622d1c
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 4da2b897283c39980d6ae09dc1560fcd937879e5
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 5c577ac939bca486cb02069505cfe47a5312ce02
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 8f6833d919bae915ead6c599a53e81e19b32da52
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 63ae78336f40bcd9a44952a7c6bafb9c88a8effd
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< a0724e40a58a0e323c59707edeae5b71d15800dc
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< e5c9ffc6ae1bcdb1062527d611043681ac301aca

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.252`	unaffected	≤ 5.10.*
`5.15.202`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[dc2251bf98c66db3f4e055b751968f0871037ae4,a0f7e804edc82e513d1ccb7c95ed8b351522ec81)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,5d103a38e2ae96eca57fd17161bcd29bd4622d1c)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,4da2b897283c39980d6ae09dc1560fcd937879e5)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,5c577ac939bca486cb02069505cfe47a5312ce02)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,8f6833d919bae915ead6c599a53e81e19b32da52)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,63ae78336f40bcd9a44952a7c6bafb9c88a8effd)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,a0724e40a58a0e323c59707edeae5b71d15800dc)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,e5c9ffc6ae1bcdb1062527d611043681ac301aca)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.14`	affected	generic	—
`[0,4.14)`	unaffected	generic	—
`[5.10.252,5.11.0)`	unaffected	semver	—
`[5.15.202,5.16.0)`	unaffected	semver	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.14,6.19.0)`	unaffected	semver	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the cpuidle_select bail‑out fix.
Ensure the machine’s firmware or device tree declares at least two idle states, for example by adding or correcting the power‑management DT node on PowerNV platforms.
If a kernel upgrade cannot be applied immediately, monitor system logs for cpuidle crash patterns and plan a timely firmware or kernel update to prevent service disruption.

Generated by OpenCVE AI on June 18, 2026 at 04:03 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4606-1	linux security update
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.130% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/4da2b897283c39980d6ae09dc1560fcd937879e5
https://git.kernel.org/stable/c/5c577ac939bca486cb02069505cfe47a5312ce02
https://git.kernel.org/stable/c/5d103a38e2ae96eca57fd17161bcd29bd4622d1c
https://git.kernel.org/stable/c/63ae78336f40bcd9a44952a7c6bafb9c88a8effd
https://git.kernel.org/stable/c/8f6833d919bae915ead6c599a53e81e19b32da52
https://git.kernel.org/stable/c/a0724e40a58a0e323c59707edeae5b71d15800dc
https://git.kernel.org/stable/c/a0f7e804edc82e513d1ccb7c95ed8b351522ec81
https://git.kernel.org/stable/c/e5c9ffc6ae1bcdb1062527d611043681ac301aca
https://lore.kernel.org/linux-cve-announce/2026052735-CVE-2026-45968-489e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45968
https://www.cve.org/CVERecord?id=CVE-2026-45968

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 6:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

May 28, 2026 3:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-125 CWE-476

May 28, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-788
References		https://lore.kernel.org/linux-cve-announce/2026052735-CVE-2026-45968-489e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45968 https://www.cve.org/CVERecord?id=CVE-2026-45968
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

May 27, 2026 9:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-476

May 27, 2026 2:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: cpuidle: Skip governor when only one idle state is available On certain platforms (PowerNV systems without a power-mgt DT node), cpuidle may register only a single idle state. In cases where that single state is a polling state (state 0), the ladder governor may incorrectly treat state 1 as the first usable state and pass an out-of-bounds index. This can lead to a NULL enter callback being invoked, ultimately resulting in a system crash. [ 13.342636] cpuidle-powernv : Only Snooze is available [ 13.351854] Faulting instruction address: 0x00000000 [ 13.376489] NIP [0000000000000000] 0x0 [ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668 Fix this by adding a bail-out in cpuidle_select() that returns state 0 directly when state_count <= 1, bypassing the governor and keeping the tick running.
Title		cpuidle: Skip governor when only one idle state is available
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4da2b897283c39980d6ae09dc1560fcd937879e5 https://git.kernel.org/stable/c/5c577ac939bca486cb02069505cfe47a5312ce02 https://git.kernel.org/stable/c/5d103a38e2ae96eca57fd17161bcd29bd4622d1c https://git.kernel.org/stable/c/63ae78336f40bcd9a44952a7c6bafb9c88a8effd https://git.kernel.org/stable/c/8f6833d919bae915ead6c599a53e81e19b32da52 https://git.kernel.org/stable/c/a0724e40a58a0e323c59707edeae5b71d15800dc https://git.kernel.org/stable/c/a0f7e804edc82e513d1ccb7c95ed8b351522ec81 https://git.kernel.org/stable/c/e5c9ffc6ae1bcdb1062527d611043681ac301aca