PT-2026-64339 · Linux · Linux
CVE-2026-64224
·
Published
2026-07-24
·
Updated
2026-07-24
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: fix double free in rvu rep rsrc init()
rvu rep rsrc init() allocates queue memory before calling
otx2 init hw resources(). When hardware resource setup fails,
otx2 init hw resources() already unwinds the partially initialized
SQ, CQ, and aura state before returning an error. The representor
error path then calls otx2 free hw resources() again and can free
the same resources a second time.
Fix this by splitting the cleanup labels so that a failure from
otx2 init hw resources() only releases queue memory. Keep the
otx2 free hw resources() call for failures that happen after
hardware resource initialization completed successfully.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc3.
Runtime validation was not performed because reproducing this path
requires OcteonTX2 representor hardware.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux