CVE-2026-45968 - Vulnerability Details

- cpuidle: Skip governor when only one idle state is available

Description

In the Linux kernel, the following vulnerability has been resolved:

cpuidle: Skip governor when only one idle state is available

On certain platforms (PowerNV systems without a power-mgt DT node),
cpuidle may register only a single idle state. In cases where that
single state is a polling state (state 0), the ladder governor may
incorrectly treat state 1 as the first usable state and pass an
out-of-bounds index. This can lead to a NULL enter callback being
invoked, ultimately resulting in a system crash.

[ 13.342636] cpuidle-powernv : Only Snooze is available
[ 13.351854] Faulting instruction address: 0x00000000
[ 13.376489] NIP [0000000000000000] 0x0
[ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668

Fix this by adding a bail-out in cpuidle_select() that returns state 0
directly when state_count <= 1, bypassing the governor and keeping the
tick running.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug occurs in the Linux kernel’s cpuidle subsystem when only one idle state is registered, typically the polling state (state 0). The ladder governor mistakenly treats a nonexistent state 1 as the first usable state, causing an out‑of‑bounds index and a NULL enter callback. This results in a kernel panic, a classic denial‑of‑service scenario. The flaw manifests as a null pointer dereference (CWE‑476) and an out‑of‑bounds index (CWE‑788).

Affected Systems

All Linux kernel builds running on platforms that expose just a single idle state, such as PowerNV systems without a power‑management device tree node, are affected. The vulnerability exists in any kernel that has not incorporated the recent bail‑out in cpuidle_select for state_count <= 1.

Risk and Exploitability

The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by firmware or boot‑time configuration rather than a remote interface, the attack vector is local; an attacker with physical or local access who can force a one‑state configuration or boot the affected hardware will cause an immediate system crash. No public exploits have been reported.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< a0f7e804edc82e513d1ccb7c95ed8b351522ec81
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 5d103a38e2ae96eca57fd17161bcd29bd4622d1c
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 4da2b897283c39980d6ae09dc1560fcd937879e5
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 5c577ac939bca486cb02069505cfe47a5312ce02
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 8f6833d919bae915ead6c599a53e81e19b32da52
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< 63ae78336f40bcd9a44952a7c6bafb9c88a8effd
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< a0724e40a58a0e323c59707edeae5b71d15800dc
`dc2251bf98c66db3f4e055b751968f0871037ae4`	affected	< e5c9ffc6ae1bcdb1062527d611043681ac301aca

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.252`	unaffected	≤ 5.10.*
`5.15.202`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[dc2251bf98c66db3f4e055b751968f0871037ae4,a0f7e804edc82e513d1ccb7c95ed8b351522ec81)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,5d103a38e2ae96eca57fd17161bcd29bd4622d1c)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,4da2b897283c39980d6ae09dc1560fcd937879e5)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,5c577ac939bca486cb02069505cfe47a5312ce02)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,8f6833d919bae915ead6c599a53e81e19b32da52)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,63ae78336f40bcd9a44952a7c6bafb9c88a8effd)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,a0724e40a58a0e323c59707edeae5b71d15800dc)`	affected	code_commit	—
`[dc2251bf98c66db3f4e055b751968f0871037ae4,e5c9ffc6ae1bcdb1062527d611043681ac301aca)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.14`	affected	generic	—
`[0,4.14)`	unaffected	generic	—
`[5.10.252,5.11.0)`	unaffected	semver	—
`[5.15.202,5.16.0)`	unaffected	semver	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.14,6.19.0)`	unaffected	semver	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the cpuidle_select bail‑out fix.
Ensure the machine’s firmware or device tree declares at least two idle states, for example by adding or correcting the power‑management DT node on PowerNV platforms.
If a kernel upgrade cannot be applied immediately, monitor system logs for cpuidle crash patterns and plan a timely firmware or kernel update to prevent service disruption.

Generated by OpenCVE AI on June 17, 2026 at 00:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4606-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4da2b897283c39980d6ae09dc1560fcd937879e5
https://git.kernel.org/stable/c/5c577ac939bca486cb02069505cfe47a5312ce02
https://git.kernel.org/stable/c/5d103a38e2ae96eca57fd17161bcd29bd4622d1c
https://git.kernel.org/stable/c/63ae78336f40bcd9a44952a7c6bafb9c88a8effd
https://git.kernel.org/stable/c/8f6833d919bae915ead6c599a53e81e19b32da52
https://git.kernel.org/stable/c/a0724e40a58a0e323c59707edeae5b71d15800dc
https://git.kernel.org/stable/c/a0f7e804edc82e513d1ccb7c95ed8b351522ec81
https://git.kernel.org/stable/c/e5c9ffc6ae1bcdb1062527d611043681ac301aca
https://lore.kernel.org/linux-cve-announce/2026052735-CVE-2026-45968-489e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45968
https://www.cve.org/CVERecord?id=CVE-2026-45968

History

Tue, 16 Jun 2026 06:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Thu, 28 May 2026 03:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-125 CWE-476

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-788
References		https://lore.kernel.org/linux-cve-announce/2026052735-CVE-2026-45968-489e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45968 https://www.cve.org/CVERecord?id=CVE-2026-45968
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 27 May 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-476

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: cpuidle: Skip governor when only one idle state is available On certain platforms (PowerNV systems without a power-mgt DT node), cpuidle may register only a single idle state. In cases where that single state is a polling state (state 0), the ladder governor may incorrectly treat state 1 as the first usable state and pass an out-of-bounds index. This can lead to a NULL enter callback being invoked, ultimately resulting in a system crash. [ 13.342636] cpuidle-powernv : Only Snooze is available [ 13.351854] Faulting instruction address: 0x00000000 [ 13.376489] NIP [0000000000000000] 0x0 [ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668 Fix this by adding a bail-out in cpuidle_select() that returns state 0 directly when state_count <= 1, bypassing the governor and keeping the tick running.
Title		cpuidle: Skip governor when only one idle state is available
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4da2b897283c39980d6ae09dc1560fcd937879e5 https://git.kernel.org/stable/c/5c577ac939bca486cb02069505cfe47a5312ce02 https://git.kernel.org/stable/c/5d103a38e2ae96eca57fd17161bcd29bd4622d1c https://git.kernel.org/stable/c/63ae78336f40bcd9a44952a7c6bafb9c88a8effd https://git.kernel.org/stable/c/8f6833d919bae915ead6c599a53e81e19b32da52 https://git.kernel.org/stable/c/a0724e40a58a0e323c59707edeae5b71d15800dc https://git.kernel.org/stable/c/a0f7e804edc82e513d1ccb7c95ed8b351522ec81 https://git.kernel.org/stable/c/e5c9ffc6ae1bcdb1062527d611043681ac301aca

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:18:27.247Z

Updated: 2026-05-27T12:18:27.247Z

Reserved: 2026-05-13T15:03:33.089Z

Link: CVE-2026-45968

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-27T14:17:13.670

Modified: 2026-06-16T02:43:34.007

Link: CVE-2026-45968

Redhat

Severity : Low

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-45968 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-17T00:30:15Z

Weaknesses

CWE-476
NULL Pointer Dereference
CWE-788
Access of Memory Location After End of Buffer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object