CVE-2026-23332: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23332 is a NULL pointer dereference vulnerability in the Linux kernel's cpufreq: intel_pstate driver that causes a kernel crash (denial of service) when turbo boost is disabled on systems with limited CPU configurations. It affects Linux kernel versions 6.16.1 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1 through 7.0-rc7. The vulnerability was introduced by commit 973207ae3d7c and disclosed on March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in the store_no_turbo function within the Intel P-State cpufreq driver. When a system boots with nosmt or maxcpus kernel command-line arguments, some CPUs are possible but not online; for these offline CPUs, the all_cpu_data[] array entries are NULL. Since commit 973207ae3d7c ("cpufreq: intel_pstate: Rearrange max frequency updates handling code"), intel_pstate_update_max_freq() iterates over all possible CPUs via for_each_possible_cpu() and dereferences all_cpu_data[] without checking for NULL, triggering a kernel panic at store_no_turbo+0x100/0x1f0. The fix passes the CPU number to intel_pstate_update_max_freq() and only accesses all_cpu_data[] for CPUs with a valid cpufreq policy (Red Hat Bugzilla, Feedly).

Successful exploitation results in a kernel panic and immediate system crash, causing a complete denial of service for the affected host. Only availability is impacted — there is no confidentiality or integrity exposure. The attack is limited to the local system; an attacker must have write access to the sysfs interface (/sys/devices/system/cpu/intel_pstate/no_turbo) and the system must have been booted with CPU-limiting kernel arguments (nosmt or maxcpus) (Feedly).

1. Precondition – Boot with limited CPUs: Ensure the target Linux system (kernel 6.16.1–6.18.16, 6.19–6.19.6, or 7.0-rc1–7.0-rc7) was booted with nosmt or maxcpus=<N> kernel command-line arguments, leaving some CPUs possible but offline.
2. Gain local access: Obtain a local shell session with a user account that has write permission to the sysfs no_turbo interface (typically requires root or equivalent privilege).
3. Trigger the crash: Execute the following command to write to the turbo disable interface:

   echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo

4. Result: The kernel iterates over all possible CPUs, dereferences a NULL all_cpu_data[] entry for an offline CPU, and triggers a kernel panic (Oops: 0000 [#1] SMP PTI), crashing the system (Red Hat Bugzilla).

• Logs: Kernel oops/panic messages in /var/log/kern.log or dmesg output containing PF: supervisor read access in kernel mode, PF: error_code(0x0000) - not-present page, Oops: Oops: 0000 [#1] SMP PTI, and RIP: 0010:store_no_turbo+0x100/0x1f0.
• System Events: Unexpected system reboot or crash on hosts booted with nosmt or maxcpus kernel parameters, coinciding with a write to /sys/devices/system/cpu/intel_pstate/no_turbo.
• Audit Logs: Auditd records showing a write operation to /sys/devices/system/cpu/intel_pstate/no_turbo by a local user immediately before a system crash.

Upgrade the Linux kernel to a patched version: 6.18.17 or later (for 6.16.1–6.18.x series), 6.19.7 or later (for 6.19.x series), or 7.0-rc2 or later (for 7.0 release candidates). Patch commits are available at 6b050482ec40, a1850e2aef4d, and d20d48916ce8 in the stable kernel tree. As a temporary workaround, avoid booting with nosmt or maxcpus kernel arguments until patching is possible, or restrict write access to /sys/devices/system/cpu/intel_pstate/no_turbo using SELinux/AppArmor policies (Red Hat Bugzilla, Feedly).