CVE-2026-64420

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in Linux Kernel cros_ec Subsystem

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded. sysfs: cannot create duplicate filename '/class/chromeos/cros_ec' Call trace: sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x44 device_add_class_symlinks+0x90/0x13c device_add+0xf0/0x50c ec_device_probe+0x150/0x4f0 platform_probe+0xa0/0xe0 ... BUG: KASAN: invalid-access in __memcpy+0x44/0x230 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125 Pointer tag: [f5], memory tag: [fe] Tainted : [W]=WARN, [O]=OOT_MODULE Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3 Workqueue: events_unbound deferred_probe_work_func Call trace: __memcpy+0x44/0x230 cros_ec_check_features+0x60/0xcc [cros_ec_proto] cros_typec_probe+0xe8/0x6e0 [cros_ec_typec] platform_probe+0xa0/0xe0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64420

EUVD

EUVD-2026-48964

Affected Vendors & Products

Vendor	Product	Version / Range
google	cros_ec	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's mfd: cros_ec driver. It occurs when ec_device_probe() fails but dev_set_drvdata() was already called, leaving a stale pointer accessible. Sub-drivers like cros_ec_typec can still access this freed memory, causing crashes or memory corruption when trying to use the device.

Detection Guidance

This vulnerability is specific to the Linux kernel's cros_ec driver and may not have direct network detection methods. Check kernel logs for errors like 'sysfs: cannot create duplicate filename' or 'BUG: KASAN: invalid-access' which indicate use-after-free issues. Commands: dmesg | grep -i 'cros_ec\|KASAN\|invalid-access' or journalctl -k | grep -i 'cros_ec\|KASAN\|invalid-access'.

Impact Analysis

If you use a system with the affected Linux kernel version, this flaw could cause system instability, crashes, or potential privilege escalation. Attackers might exploit it to execute arbitrary code or cause denial-of-service conditions on vulnerable devices.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's cros_ec driver, which could lead to memory corruption or crashes. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a distribution kernel, apply the latest stable updates. Monitor kernel logs for related errors after updating.

Hi! I’m here to help you understand CVE-2026-64420. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70