CVE-2026-64377
In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to one element of this array in policy->driver_data. qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data. This is not valid because the memory is devm-managed. For the first domain, this can free the devm-managed allocation while the devres entry is still active, leading to a possible double free when the platform device is later detached. For other domains, the pointer may refer to an element inside the array rather than the allocation base. Remove the kfree(data) call and let devres release qcom_cpufreq.data. This issue was found by a static analysis tool I am developing.
Affected versions
Linux kernel versions
6.2
and later are affected. Fixed in
6.12.96,
6.18.39,
7.1.4,
7.2-rc1
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-64377?
CVE-2026-64377 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.2 onward and has been patched in 6.12.96, 6.18.39, 7.1.4 and others. CVE-2026-64377 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64377?
Yes. CVE-2026-64377 has been patched. Fixed versions include 6.12.96, 6.18.39, 7.1.4 and others. If you are running Linux kernel 6.2 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64377 actively exploited?
No. CVE-2026-64377 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.