PT-2026-38979 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-16 · CVE-2026-43328

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double free issue exists in the cpufreq dbs governor init() function error path. When the kobject init and add() function fails, the system calls kobject put(&dbs data->attr set.kobj), which triggers the cpufreq dbs data release() callback. This callback executes gov->exit(dbs data) and kfree(dbs data). However, the error path subsequently calls gov->exit(dbs data) and kfree(dbs data) again, leading to a double free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-43328

Affected Products

Linux Kernel

References · 18

• https://ubuntu.com/security/CVE-2026-43328 · Vendor Advisory
• https://git.kernel.org/stable/c/56bc91ee78babe9578585a2bc137abc4b3115ff3 · Patch
• https://cve.org/CVERecord?id=CVE-2026-43328 · Security Note
• https://git.kernel.org/stable/c/019ea28629720c220daedf38107c8787f330dc05 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43328 · Vendor Advisory
• https://git.kernel.org/stable/c/da39ee627fd82b52068d4d5f115749a8b7d271f9 · Patch
• https://git.kernel.org/stable/c/427d048e4f6acbfa01b5a8062449fe0ee8987c0d · Patch
• https://git.kernel.org/stable/c/6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43328 · Vendor Advisory
• https://git.kernel.org/stable/c/3bf9d023d2329a0e5379f2fd09d06ef09729cd9d · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43328 · Vendor Advisory
• https://git.kernel.org/stable/c/d2703b4f8fb7cc6f0dfdb2dc2359cc46189e7357 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43328 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43328 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2052812432993595626 · Twitter Post