PT-2026-64598 · Linux · Linux

CVE-2026-64377 · Published 2026-07-25 · Updated 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: qcom-cpufreq-hw: Fix possible double free

qcom cpufreq.data is allocated with devm kzalloc() in probe() as an array of per-domain data. qcom cpufreq hw cpu init() stores a pointer to one element of this array in policy->driver data.

qcom cpufreq hw cpu exit() currently calls kfree() on policy->driver data. This is not valid because the memory is devm-managed. For the first domain, this can free the devm-managed allocation while the devres entry is still active, leading to a possible double free when the platform device is later detached. For other domains, the pointer may refer to an element inside the array rather than the allocation base.

Remove the kfree(data) call and let devres release qcom cpufreq.data.

This issue was found by a static analysis tool I am developing.

Related Identifiers

CVE-2026-64377

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-64377 · Security Note
• https://git.kernel.org/stable/c/e904961332801c87355f5d11c65bb433e717c489 · Note
• https://git.kernel.org/stable/c/9de568ef6cdfc7912d5ea8db02843c0e4ef0c75d · Note
• https://git.kernel.org/stable/c/28a03a3f6e6cda0b0da3b43761d175dec5d14d13 · Note
• https://git.kernel.org/stable/c/bcb8889c4981fdde42d4fd2c29a77d510fe21da2 · Note