CVE-2025-40194

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

The cpufreq_cpu_put() call in update_qos_request() takes place too early

because the latter subsequently calls freq_qos_update_request() that

indirectly accesses the policy object in question through the QoS request

object passed to it.

Fortunately, update_qos_request() is called under intel_pstate_driver_lock,

so this issue does not matter for changing the intel_pstate operation

mode, but it theoretically can cause a crash to occur on CPU device hot

removal (which currently can only happen in virt, but it is formally

supported nevertheless).

Address this issue by modifying update_qos_request() to drop the

reference to the policy later.