Skip to main content

Linux Kernel EUVDEUVD-2026-48921

| CVE-2026-64377 HIGH
Double Free (CWE-415)
2026-07-25 Linux GHSA-9gw4-rc8j-j633
Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC:H reflects that reliable double-free exploitation requires heap grooming; all other metrics match the local, low-priv kernel privilege escalation profile.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 08, 2026 - 16:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Sep 08, 2026 - 16:37 vuln.today
CVSS changed
Sep 08, 2026 - 14:22 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: qcom-cpufreq-hw: Fix possible double free

qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to one element of this array in policy->driver_data.

qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data. This is not valid because the memory is devm-managed. For the first domain, this can free the devm-managed allocation while the devres entry is still active, leading to a possible double free when the platform device is later detached. For other domains, the pointer may refer to an element inside the array rather than the allocation base.

Remove the kfree(data) call and let devres release qcom_cpufreq.data.

This issue was found by a static analysis tool I am developing.

AnalysisAI

Double-free memory corruption in the Linux kernel's Qualcomm CPU frequency hardware driver (qcom-cpufreq-hw) allows a local low-privileged attacker on Qualcomm SoC-based systems to trigger kernel heap corruption, potentially escalating privileges to root. The flaw originates in qcom_cpufreq_hw_cpu_exit(), which incorrectly calls kfree() on memory allocated via devm_kzalloc() - memory already tracked by the kernel's device resource management (devres) system. This results in a double-free when the platform device is subsequently detached and devres performs its own cleanup. No public exploit code exists and EPSS is low (0.21%), consistent with a static-analysis discovery rather than active exploitation.

Technical ContextAI

The vulnerability resides in the cpufreq subsystem's Qualcomm hardware driver (drivers/cpufreq/qcom-cpufreq-hw.c), affecting Linux kernel versions from commit 054a3ef683a1 onward until the respective stable-branch fixes. The root cause (CWE-415, Double Free) is a lifecycle mismatch: qcom_cpufreq.data is allocated with devm_kzalloc() in probe(), binding its lifetime to the platform device via devres. qcom_cpufreq_hw_cpu_init() stores a pointer to an element within this array in policy->driver_data. When qcom_cpufreq_hw_cpu_exit() later calls kfree(policy->driver_data), it frees devm-managed memory prematurely. On first-domain exit this frees the allocation base while the devres entry remains active; on other domains the pointer targets an interior array element rather than the allocation base, both producing undefined behavior. The devres layer then issues a second free on device detach, completing the double-free. CPE cpe:2.3:a:linux:linux:* confirms the Linux kernel is the affected component.

RemediationAI

Update the Linux kernel to a patched stable release: 6.12.96 or later on the 6.12 branch, 6.18.39 or later on the 6.18 branch, 7.1.4 or later on the 7.1 branch, or any 7.2-rc1+ development release. Ubuntu users should apply the updates referenced in USN-8727-1 (https://ubuntu.com/security/notices/USN-8727-1) and USN-8726-1 (https://ubuntu.com/security/notices/USN-8726-1). Upstream fix commits are available at https://git.kernel.org/stable/c/28a03a3f6e6cda0b0da3b43761d175dec5d14d13, https://git.kernel.org/stable/c/e904961332801c87355f5d11c65bb433e717c489, https://git.kernel.org/stable/c/9de568ef6cdfc7912d5ea8db02843c0e4ef0c75d, and https://git.kernel.org/stable/c/bcb8889c4981fdde42d4fd2c29a77d510fe21da2. The fix removes the erroneous kfree(data) call in qcom_cpufreq_hw_cpu_exit() and allows devres to manage the memory lifetime correctly. As a compensating control on systems that cannot be patched immediately, restricting unprivileged access to CPU hotplug or device removal interfaces (e.g., via systemd service hardening or kernel lockdown) reduces the attack surface, though this may impact power management functionality.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

EUVD-2026-48921 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy