{"cve":"CVE-2026-89572","nvd":{"published":"2026-09-11T20:19:41.270","modified":"2026-10-21T13:20:09.137","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: apple-soc: Fix OPP table cleanup\n\napple_soc_cpufreq_init() adds OPP tables from firmware, but\nsome failure paths do not remove them. The driver also uses\ndev_pm_opp_remove_all_dynamic(), which is not the right cleanup\nhelper for OPP tables loaded from firmware.\n\nUse the cpumask OPP helper after the policy CPU mask has been\npopulated. Pair it with the matching cpumask remove helper on\nfailure paths and in apple_soc_cpufreq_exit(). This also removes\nthe separate dev_pm_opp_set_sharing_cpus() call, as the cpumask\nhelper loads the DT OPP tables for all CPUs in the policy.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/12b54e5aab7c0850d39a51a32200f76d5e15040e","https://git.kernel.org/stable/c/36c55d118d5ecd2fb444f52802955903937b9ccd","https://git.kernel.org/stable/c/7c19b94c625dc7042b0a7dff4c8da158358ffa2c","https://git.kernel.org/stable/c/d28ad9bb050e80770f0b644304cb75932e289238","https://git.kernel.org/stable/c/d87cb889dc7ab1f2deecadf2a5e9023184bd7900"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-89572","score":0.00168,"percentile":0.06154,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}