CVE-2026-97905

A low impact flaw was found in the Linux kernel's CPU frequency scaling (cpufreq) subsystem. When a cpufreq policy is created, the policy's CPU mask (policy->cpus) is allocated without zero-initialization, and the policy's sysfs attributes are published before the mask receives its first valid value. On kernels built with CONFIG_CPUMASK_OFFSTACK=y, a local user who accesses these sysfs attributes during the window between sysfs publication and mask initialization can cause the show()/store() attribute callbacks to execute against an uninitialized policy, which can crash the kernel and result in a local denial of service. Exploitation requires winning a narrow race during CPU online (hotplug) operations, and only system availability is affected; confidentiality and integrity are not. The Red Hat Product Security impact is assessed as low because successful exploitation depends on the timing race and on residual slab contents, limiting the practical consequence to a system crash; this is lower in practice than the CVSS:3.1 base score of 5.5 (moderate) would suggest. Red Hat Enterprise Linux 7, 8, 9, and 10 (including ELS streams and z-stream updates), RHEL In-Vehicle OS 2, and Red Hat OpenShift Container Platform 4 and 5 are affected; the RHEL 6 stream is out of support (OOSS) and no update is planned. Because the impact is low and exploitation requires an unreliable race during CPU hotplug, the fix (zero-initializing the policy cpumask before sysfs publication) is deferred to a future scheduled kernel update for the affected streams; the residual risk is limited to local denial of service through a system crash triggered during CPU onlining.