Skip to main content

Linux Kernel CVE-2026-64224

| EUVDEUVD-2026-48632 HIGH
Double Free (CWE-415)
2026-07-24 Linux GHSA-8rr8-rp2r-rgh8
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC:H reflects the hardware-specific representor configuration and induced error-path condition required to trigger the double free; all other metrics match the local, low-privilege kernel impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 02:31 vuln.today
CVSS changed
Aug 12, 2026 - 00:22 NVD
7.8 (HIGH)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 24, 2026 - 15:23 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: fix double free in rvu_rep_rsrc_init()

rvu_rep_rsrc_init() allocates queue memory before calling otx2_init_hw_resources(). When hardware resource setup fails, otx2_init_hw_resources() already unwinds the partially initialized SQ, CQ, and aura state before returning an error. The representor error path then calls otx2_free_hw_resources() again and can free the same resources a second time.

Fix this by splitting the cleanup labels so that a failure from otx2_init_hw_resources() only releases queue memory. Keep the otx2_free_hw_resources() call for failures that happen after hardware resource initialization completed successfully.

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3.

Runtime validation was not performed because reproducing this path requires OcteonTX2 representor hardware.

AnalysisAI

Double free memory corruption in the Linux kernel's OcteonTX2 PF representor driver allows a local low-privileged user on hardware-equipped systems to corrupt kernel slab allocator state via rvu_rep_rsrc_init(), potentially enabling privilege escalation to root. The defect was identified by an experimental static analysis tool during review of v6.13-rc1 and confirmed present through v7.1-rc3 via manual inspection. No active exploitation is confirmed (not in CISA KEV), no public exploit code exists, and vendor-released patches are available across multiple stable kernel branches.

Technical ContextAI

The vulnerability resides in the octeontx2-pf kernel module, which drives Marvell's OcteonTX2 (OCTEON TX2) network packet-forwarding ASIC family used in high-throughput networking appliances and SmartNICs. The affected function rvu_rep_rsrc_init() pre-allocates queue structures - send queues (SQ), completion queues (CQ), and memory aura pools - before delegating to otx2_init_hw_resources() for hardware-side setup. When otx2_init_hw_resources() fails, it internally unwinds partial initialization of SQ, CQ, and aura state before returning an error. The representor error path then unconditionally calls otx2_free_hw_resources() a second time on those already-freed structures, constituting CWE-415 (Double Free). In the Linux kernel slab allocator, a double free corrupts freelist metadata, creating memory confusion primitives that can be leveraged for controlled kernel memory writes or type confusion. The upstream CPE (cpe:2.3:a:linux:linux:*) reflects that this is a mainline kernel defect spanning multiple stable series from the introduction commit (3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a) onward.

RemediationAI

The primary fix is to upgrade to a patched kernel version: Linux 7.1, 7.0.11, or 6.18.34 depending on the stable branch in use. Upstream stable commits can be reviewed at https://git.kernel.org/stable/c/8864b664d0443ecb8e56690e5546fcda5fe5e81b, https://git.kernel.org/stable/c/eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad, and https://git.kernel.org/stable/c/e8fb3de2a8effcaf62bec2c56b93d8bb480371d1. Ubuntu users should apply USN-8618-1 via standard package management (apt upgrade). As a compensating control for systems that cannot be immediately patched, administrators can blacklist or unload the octeontx2-pf module using 'modprobe -r octeontx2-pf' and persisting the blacklist via /etc/modprobe.d/ - this eliminates the vulnerable code path entirely but disables all OcteonTX2 network functionality, which is an operational trade-off only viable when the hardware is not actively in use. Restricting local interactive access to affected hosts limits the attacker pool, since PR:L is a hard prerequisite.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64224 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy