CVE-2025-40194
In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it. Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless). Address this issue by modifying update_qos_request() to drop the reference to the policy later.
Affected versions
Linux kernel versions
5.4
and later are affected. Fixed in
5.4.301,
5.10.246,
5.15.195,
6.1.157,
6.6.113,
6.12.54,
6.17.4,
6.18
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2025-40194?
CVE-2025-40194 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.4 onward and has been patched in 5.4.301, 5.10.246, 5.15.195 and others. CVE-2025-40194 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2025-40194?
Yes. CVE-2025-40194 has been patched. Fixed versions include 5.4.301, 5.10.246, 5.15.195 and others. If you are running Linux kernel 5.4 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2025-40194 actively exploited?
No. CVE-2025-40194 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.