Object Lifecycle Issue in Intel P-state Driver of Linux Kernel

CVE-2025-40194

What is CVE-2025-40194?

A vulnerability has been identified in the Linux kernel's intel_pstate driver related to object lifecycle management within the update_qos_request() function. The cpufreq_cpu_put() call is executed prematurely, which can potentially lead to a crash during CPU device hot removal. Although this is primarily a concern in virtualized environments, it highlights a flaw in reference management of the policy object accessed via the QoS request. Remedying this issue involves adjusting the timing of the reference drop within the update_qos_request() to ensure stability.

References