In the Linux kernel, the cpufreq subsystem allocates a policy->cpus mask without zero‑initialising it when CONFIG_CPUMASK_OFFSTACK is enabled. During early sysfs publication the mask contains garbage bits, so attribute callbacks that normally run only on fully initialised policies are invoked with a policy that is not ready. This can lead to undefined kernel behaviour, potentially causing a crash or other instability that renders the system unusable.

The issue affects any Linux kernel that builds the cpufreq subsystem with CONFIG_CPUMASK_OFFSTACK=y. No specific kernel versions are listed, so the problem is likely present in all affected builds until the patch is applied.

The CVSS score is 5.5, the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. It can cause a kernel crash or denial of service; thus the potential impact is significant. The likelihood of exploitation depends on an attacker’s ability to trigger the uninitialised sysfs attributes, which may be limited but still represents a risk for systems exposed to malicious users. Based on the description, the likely attack vector is local or privileged access to the cpufreq sysfs interface before the policy is fully initialised.