{"id":"CVE-2026-23332","title":"cpufreq: intel_pstate: Fix crash during turbo disable","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: intel_pstate: Fix crash during turbo disable\n\nWhen the system is booted with kernel command line argument \"nosmt\" or\n\"maxcpus\" to limit the number of CPUs, dis…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 973207ae3d7c3c92df4a382df5d7bd695deaa904 < a1850e2aef4d15405e7ff53fd51c4b3124d46182","Linux >= 973207ae3d7c3c92df4a382df5d7bd695deaa904 < d20d48916ce8531b157c2edeba76d69af2974270","Linux >= 973207ae3d7c3c92df4a382df5d7bd695deaa904 < 6b050482ec40569429d963ac52afa878691b04c9","Linux 6.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:27:07.180053Z"},"published":"2026-03-25","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:33:39.269Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23332","references":[{"url":"https://git.kernel.org/stable/c/a1850e2aef4d15405e7ff53fd51c4b3124d46182"},{"url":"https://git.kernel.org/stable/c/d20d48916ce8531b157c2edeba76d69af2974270"},{"url":"https://git.kernel.org/stable/c/6b050482ec40569429d963ac52afa878691b04c9"}],"tags":["cve.org"],"epss":0.00125,"epssPercentile":0.02251,"ingestedAt":"2026-11-05T22:38:32.116Z","slug":"CVE-2026-23332","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: intel_pstate: Fix crash during turbo disable\n\nWhen the system is booted with kernel command line argument \"nosmt\" or\n\"maxcpus\" to limit the number of CPUs, disabling turbo via:\n\n echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo\n\nresults in a crash:\n\n PF: supervisor read access in kernel mode\n PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP PTI\n ...\n RIP: 0010:store_no_turbo+0x100/0x1f0\n ...\n\nThis occurs because for_each_possible_cpu() returns CPUs even if they\nare not online. For those CPUs, all_cpu_data[] will be NULL. Since\ncommit 973207ae3d7c (\"cpufreq: intel_pstate: Rearrange max frequency\nupdates handling code\"), all_cpu_data[] is dereferenced even for CPUs\nwhich are not online, causing the NULL pointer dereference.\n\nTo fix that, pass CPU number to intel_pstate_update_max_freq() and use\nall_cpu_data[] for those CPUs for which there is a valid cpufreq policy.\n\n## Affected\n\n- `Linux >= 973207ae3d7c3c92df4a382df5d7bd695deaa904 < a1850e2aef4d15405e7ff53fd51c4b3124d46182`\n- `Linux >= 973207ae3d7c3c92df4a382df5d7bd695deaa904 < d20d48916ce8531b157c2edeba76d69af2974270`\n- `Linux >= 973207ae3d7c3c92df4a382df5d7bd695deaa904 < 6b050482ec40569429d963ac52afa878691b04c9`\n- `Linux 6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}