A null pointer dereference vulnerability was identified and fixed in the Linux kernel's cpufreq subsystem, specifically in the CPPC code path. The function cppc_get_cpu_cost() could dereference a NULL pointer if cpufreq_cpu_get_raw() returned NULL when the CPU was not in the policy's CPU mask. This issue could lead to a denial of service due to kernel crash.