---
id: CVE-2026-90364
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: processor: Unregister cpufreq notifier on init failure

  acpi_processor_driver_init() registers the cpufreq policy notifier before
  registering the ACPI processor d…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: processor: Unregister cpufreq notifier on init failure

  acpi_processor_driver_init() registers the cpufreq policy notifier before
  registering the ACPI processor d…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c0e0421a60bf468e88cf569fbd727346b138ed04 <
    ccee0785030978c49505e04954eee3f30a5f01ca
  - >-
    Linux >= c0e0421a60bf468e88cf569fbd727346b138ed04 <
    8f3036c5de8b651880f323e223b1604b6cfbff21
  - >-
    Linux >= c0e0421a60bf468e88cf569fbd727346b138ed04 <
    64976f3b34b07eb866ead4052cefe7e9ff45fd2f
  - >-
    Linux >= c0e0421a60bf468e88cf569fbd727346b138ed04 <
    182cd086b31ea4ccc1d8f2ec5b81e988dfe0b892
  - >-
    Linux >= c0e0421a60bf468e88cf569fbd727346b138ed04 <
    06f32dd67e6b23a05bef0d8183c5335af91c0c3b
  - Linux 6.3
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:35.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90364'
references:
  - url: 'https://git.kernel.org/stable/c/06f32dd67e6b23a05bef0d8183c5335af91c0c3b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/182cd086b31ea4ccc1d8f2ec5b81e988dfe0b892'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/64976f3b34b07eb866ead4052cefe7e9ff45fd2f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8f3036c5de8b651880f323e223b1604b6cfbff21'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ccee0785030978c49505e04954eee3f30a5f01ca'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90364.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-90364'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536751'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-90364'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90364'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90364.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-17T16:21:47.811Z'
epss: 0.00206
epssPercentile: 0.10484
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-772
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ACPI: processor: Unregister cpufreq notifier on init failure

acpi_processor_driver_init() registers the cpufreq policy notifier before
registering the ACPI processor driver and setting up CPU hotplug state.

If driver_register() or cpuhp_setup_state() fails, the error path only
unregisters the ACPI processor driver and the idle driver. The cpufreq
notifier remains registered even though initialization failed.

Mirror the module exit path on the init failure path and unregister the
cpufreq notifier when it has been registered.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90364.json)