The Linux kernel contained a race condition in the cpufreq subsystem during system reboot. Specifically, cpufreq_suspend() is invoked via kernel_restart() -> device_shutdown() without freezing user and kernel processes, unlike the normal suspend path. This allows CPU hotplug operations to execute concurrently with cpufreq_suspend(), leading to a race where governor_data may be freed while still in use. This results in a null pointer dereference and kernel crash. The vulnerability is resolved by adding cpus_read_lock()/cpus_read_unlock() around cpufreq_suspend() to block CPU hotplug operations during suspend.

The vulnerability can cause a kernel NULL pointer dereference during system reboot, leading to a kernel crash (panic). This disrupts system availability and stability during reboot sequences. There is no indication of privilege escalation or data corruption beyond the denial of service caused by the kernel fault.

A fix has been implemented in the Linux kernel source code by adding synchronization primitives to cpufreq_suspend() to prevent concurrent CPU hotplug operations. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly stated here; check the vendor or Linux kernel mailing list advisories for the specific fixed kernel versions and apply updates accordingly.