CVE-2026-89572 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users who rely on the cpufreq: apple-soc component, should assess exposure and apply patches to prevent potential resource leaks or issues. This includes verifying affected versions of the Linux kernel, assessing exposure, and applying patches to prevent potential issues. Additionally, users should monitor for any potential resource leaks or issues related to OPP tables.

Why it matters

A vulnerability in the Linux kernel's cpufreq: apple-soc component has been addressed, requiring verification of affected versions and application of patches to prevent potential resource leaks or issues.

• Verification of affected versions is required to determine exposure.
• Proper cleanup of OPP tables is necessary to prevent resource leaks.
• Assessment of exposure and application of patches is necessary to prevent potential issues.

Technical summary

The Linux kernel's cpufreq: apple-soc component has a vulnerability related to improper cleanup of OPP tables from firmware on certain failure paths. The issue has been addressed by the Linux kernel maintainers, who have used the cpumask OPP helper after the policy CPU mask has been populated, pairing it with the matching cpumask remove helper on failure paths and in apple_soc_cpufreq_exit(). This change also removes the separate dev_pm_opp_set_sharing_cpus() call, as the cpumask helper loads the DT OPP tables for all CPUs in the policy. Users should review and apply the patches provided to ensure proper cleanup of OPP tables.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers to ensure proper cleanup of OPP tables.
• Verify the affected versions of the Linux kernel and assess exposure.
• Monitor for any potential resource leaks or issues related to OPP tables.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the impact and affected versions are not explicitly stated, requiring verification from official sources. The Linux kernel maintainers have addressed the issue, and users should review and apply the patches provided to ensure proper cleanup of OPP tables. The affected versions of the Linux kernel need to be verified to determine exposure, and assessment of exposure and application of patches is necessary to prevent potential issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.