CVE-2026-64420
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded. sysfs: cannot create duplicate filename '/class/chromeos/cros_ec' Call trace: sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x44 device_add_class_symlinks+0x90/0x13c device_add+0xf0/0x50c ec_device_probe+0x150/0x4f0 platform_probe+0xa0/0xe0 ... BUG: KASAN: invalid-access in __memcpy+0x44/0x230 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125 Pointer tag: [f5], memory tag: [fe] Tainted : [W]=WARN, [O]=OOT_MODULE Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3 Workqueue: events_unbound deferred_probe_work_func Call trace: __memcpy+0x44/0x230 cros_ec_check_features+0x60/0xcc [cros_ec_proto] cros_typec_probe+0xe8/0x6e0 [cros_ec_typec] platform_probe+0xa0/0xe0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64420
EUVD
EUVD-2026-48964

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
google cros_ec *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's mfd: cros_ec driver. It occurs when ec_device_probe() fails but dev_set_drvdata() was already called, leaving a stale pointer accessible. Sub-drivers like cros_ec_typec can still access this freed memory, causing crashes or memory corruption when trying to use the device.

Detection Guidance

This vulnerability is specific to the Linux kernel's cros_ec driver and may not have direct network detection methods. Check kernel logs for errors like 'sysfs: cannot create duplicate filename' or 'BUG: KASAN: invalid-access' which indicate use-after-free issues. Commands: dmesg | grep -i 'cros_ec\|KASAN\|invalid-access' or journalctl -k | grep -i 'cros_ec\|KASAN\|invalid-access'.

Impact Analysis

If you use a system with the affected Linux kernel version, this flaw could cause system instability, crashes, or potential privilege escalation. Attackers might exploit it to execute arbitrary code or cause denial-of-service conditions on vulnerable devices.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a distribution kernel, apply the latest stable updates. Monitor kernel logs for related errors after updating.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64420. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart