CVE-2026-64377
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to one element of this array in policy->driver_data. qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data. This is not valid because the memory is devm-managed. For the first domain, this can free the devm-managed allocation while the devres entry is still active, leading to a possible double free when the platform device is later detached. For other domains, the pointer may refer to an element inside the array rather than the allocation base. Remove the kfree(data) call and let devres release qcom_cpufreq.data. This issue was found by a static analysis tool I am developing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64377
EUVD
EUVD-2026-48921

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qcom qcom_cpufreq *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a double free issue in the Linux kernel's Qualcomm CPU frequency driver (qcom-cpufreq-hw). It occurs because the driver incorrectly calls kfree() on memory that was allocated with devm_kzalloc(), which is managed by the device resource system. This can lead to a double free when the platform device is detached.

Detection Guidance

This vulnerability is specific to the Linux kernel's cpufreq subsystem, particularly the qcom-cpufreq-hw driver. Detection requires checking the kernel version and the presence of the vulnerable code path. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep qcom_cpufreq_hw' to see if the driver is loaded.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited. It may lead to kernel panics or unexpected behavior when the affected driver is used. Systems using Qualcomm CPUs with this driver are at risk.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-64377. If updating is not immediately possible, consider disabling the qcom-cpufreq-hw driver if it is not required for your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64377. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart