PT-2026-64641 · Linux · Linux
CVE-2026-64420
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
mfd: cros ec: Delay dev set drvdata() until probe success
If ec device probe() fails, cros ec class release releases memory for the
cros ec dev structure. However, because the drvdata was already set,
sub-drivers like cros ec typec can still retrieve the stale pointer via the
platform device. This leads to a use-after-free when cros ec typec attempts
to access &typec->ec->ec->dev on a device that has already been released.
Move dev set drvdata() to ensure that the pointer is only made available
once all initialization steps have succeeded.
sysfs: cannot create duplicate filename '/class/chromeos/cros ec'
Call trace:
sysfs do create link sd+0x94/0xdc
sysfs create link+0x30/0x44
device add class symlinks+0x90/0x13c
device add+0xf0/0x50c
ec device probe+0x150/0x4f0
platform probe+0xa0/0xe0
...
BUG: KASAN: invalid-access in memcpy+0x44/0x230
Write at addr f5ffff809e2d33ac by task kworker/u32:5/125
Pointer tag: [f5], memory tag: [fe]
Tainted : [W]=WARN, [O]=OOT MODULE
Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3
Workqueue: events unbound deferred probe work func
Call trace:
memcpy+0x44/0x230
cros ec check features+0x60/0xcc [cros ec proto]
cros typec probe+0xe8/0x6e0 [cros ec typec]
platform probe+0xa0/0xe0
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux