CVE-2026-64224
Received Received - Intake

Double Free in OcteonTX2 PF Driver

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix double free in rvu_rep_rsrc_init() rvu_rep_rsrc_init() allocates queue memory before calling otx2_init_hw_resources(). When hardware resource setup fails, otx2_init_hw_resources() already unwinds the partially initialized SQ, CQ, and aura state before returning an error. The representor error path then calls otx2_free_hw_resources() again and can free the same resources a second time. Fix this by splitting the cleanup labels so that a failure from otx2_init_hw_resources() only releases queue memory. Keep the otx2_free_hw_resources() call for failures that happen after hardware resource initialization completed successfully. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime validation was not performed because reproducing this path requires OcteonTX2 representor hardware.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64224
EUVD
EUVD-2026-48632

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double-free vulnerability in the Linux kernel's octeontx2-pf driver. The function rvu_rep_rsrc_init() allocates queue memory before calling otx2_init_hw_resources(). If hardware setup fails, otx2_init_hw_resources() already cleans up partially initialized resources. The error path then calls otx2_free_hw_resources() again, freeing the same resources twice.

Detection Guidance

This vulnerability is specific to the OcteonTX2 PF driver in the Linux kernel and requires hardware representor resources to trigger. Detection would typically involve checking kernel logs for double-free errors or crashes related to rvu_rep_rsrc_init(). No public commands are available for detection as it requires specialized hardware.

Impact Analysis

This vulnerability could cause kernel memory corruption or crashes if exploited. It specifically affects systems using OcteonTX2 representor hardware. Exploitation may lead to denial-of-service conditions or potential privilege escalation.

Compliance Impact

This vulnerability is a double-free issue in the Linux kernel's octeontx2-pf driver, which could lead to memory corruption or system instability. It does not directly relate to data handling, privacy, or security controls typically addressed by GDPR or HIPAA. Compliance impact would depend on whether the affected system processes regulated data, but the vulnerability itself does not inherently violate these standards.

Mitigation Strategies

Apply the kernel patch that fixes the double-free issue in rvu_rep_rsrc_init(). If using affected kernel versions, update to a patched version or disable the OcteonTX2 PF driver if not in use. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64224. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart