The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() is called via the     kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does     not call freeze_processes(), so userspace processes and kernel threads remain active. This allows CPU     hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization     with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while     cpufreq_suspend() is still accessing it, resulting in a null pointer dereference: Unable to handle kernel     NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160     device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200 Fix this by adding     cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is     in progress. [ rjw: Changelog edits ] (CVE-2026-64373)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-64373

medium Nessus Plugin ID 329831

Version 1.22