The vulnerability is a race condition in the Linux kernel's cpufreq subsystem that occurs during system reboot. When the system reboots, cpufreq_suspend() runs without the usual process freeze, allowing CPU hotplug operations to proceed concurrently. The code accesses governor_data that can be freed by the hotplug path, leading to a null pointer dereference and a kernel crash. This results in an unexpected reboot or loss of system control, which effectively causes a denial of service for any user or process on the machine.

All Linux kernel builds that lack the recent patch (commit 6d5dd354c37ab…) and run the cpufreq module are affected. Vendors offering Linux kernels that have not yet incorporated this fix should check if their releases include the commit or are based on a kernel older than the fix.

The EPSS score is less than 1 % indicating only a very low probability of exploitation. The issue does not appear in the CISA KEV list. Exploitation requires the ability to reboot the system because the race manifests only along the kernel_restart() path, which is generally restricted to privileged (root or equivalent) users. Consequently, the risk to an attacker confined to a normal user account is negligible, but the impact to a system if an adversary obtains reboot rights or can trigger a reboot during hotplug activity is significant.