CVE-2026-64222
Received Received - Intake

Double Free in Linux Kernel OcteonTX2 PF Driver

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific cn20k_pool_aq_init() implementation has the same bug in its corresponding error path. Set pool->stack to NULL immediately after the local free so the shared cleanup path does not free the same stack again while cleaning up partially initialized pool state. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime validation was not performed because reproducing this path requires OcteonTX2/CN20K hardware.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64222
EUVD
EUVD-2026-48630

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 7.1-rc3 (exc)
linux linux_kernel to 6.13-rc1 (inc)
linux kernel From 7.1-rc3 (exc)
linux kernel to 6.13-rc1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double-free vulnerability in the Linux kernel's OcteonTX2/CN20K driver. When initializing a hardware queue pool, if an error occurs during mailbox synchronization or memory allocation, the function frees the pool's stack memory but does not clear the pointer. Later, cleanup code attempts to free the same stack memory again, causing a crash or undefined behavior.

Detection Guidance

This vulnerability is specific to OcteonTX2/CN20K hardware and requires runtime validation on affected systems. Detection may involve checking kernel logs for double-free errors or memory corruption related to pool->stack during driver initialization. No public commands are available due to hardware-specific requirements.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. It specifically affects systems using OcteonTX2 or CN20K network hardware with vulnerable Linux kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a memory management bug in the Linux kernel specific to OcteonTX2/CN20K hardware. Compliance impacts would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. If using OcteonTX2/CN20K hardware, update to a patched kernel version. Monitor kernel logs for related errors and avoid triggering the specific error paths during driver initialization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64222. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart