Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L H L N U N N H 4.7 .0009 0.4 —
AFFECTED Product Versions Fixed Linux 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 – — Linux 5.4 – 5.10.261
TIMELINE Jul 19 Reserved by Linux Jul 25 Published (CNA: Linux) Sep 8 ENRICHED — CVE-2026-64373 (Linux). Received CVSS 4.7 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active. This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference: Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200 Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress. [ rjw: Changelog edits ]
| Date | Event | Detail |
|---|---|---|
| July 19, 2026 | Reserved | Reserved by Linux |
| July 25, 2026 | Published | Published (CNA: Linux) |
| September 8, 2026 | ENRICHED | ENRICHED — CVE-2026-64373 (Linux). Received CVSS 4.7 and CPE data from NVD. |
Authoritative record: CVE-2026-64373 at cve.org
Vendors: linux
Weaknesses: CWE-362
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64373 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
