What’s Vulnerable › Vulnerabilities

CVE-2026-90364: ACPI: processor: Unregister cpufreq notifier on init failure

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Unregister cpufreq notifier on init failure acpi_processor_driver_init() registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driver_register() or cpuhp_setup_state() fails, the error path only unregisters the ACPI processor driver and the idle driver. The cpufreq notifier remains registered even though initialization failed. Mirror the module exit path on the init failure path and unregister the cpufreq notifier when it has been registered.

Affected products

• Linux kernel: 6.3 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/06f32dd67e6b23a05bef0d8183c5335af91c0c3b
• https://git.kernel.org/stable/c/182cd086b31ea4ccc1d8f2ec5b81e988dfe0b892
• https://git.kernel.org/stable/c/64976f3b34b07eb866ead4052cefe7e9ff45fd2f
• https://git.kernel.org/stable/c/8f3036c5de8b651880f323e223b1604b6cfbff21
• https://git.kernel.org/stable/c/ccee0785030978c49505e04954eee3f30a5f01ca

Get alerted when CVE-2026-90364 or the next vulnerability affects your stack