Log in Start free

Vulnerability · Published Jul 25, 2026 · Assigned by Linux

CVE-2026-64377cpufreq: qcom-cpufreq-hw: Fix possible double free

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.1%top 97.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to one element of this array in policy->driver_data. qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data. This is not valid because the memory is devm-managed. For the first domain, this can free the devm-managed allocation while the devres entry is still active, leading to a possible double free when the platform device is later detached. For other domains, the pointer may refer to an element inside the array rather than the allocation base. Remove the kfree(data) call and let devres release qcom_cpufreq.data. This issue was found by a static analysis tool I am developing.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.96-1DEBIAN-CVE-2026-64377
Debian:14linux7.1.4-1DEBIAN-CVE-2026-64377
Debian:12linux-6.126.12.100-1~deb12u1DEBIAN-CVE-2026-64377
Ubuntu:24.04:LTSlinux6.8.0-147.147UBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux7.0.0-31.31UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-aws6.8.0-1067.70UBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-aws7.0.0-1012.12UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-aws-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-aws-7.07.0.0-1012.12~24.04.1UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure6.8.0-1071.79UBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-azure7.0.0-1014.14UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-azure-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-7.07.0.0-1014.14~24.04.1UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1069.76UBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-azure-fde7.0.0-1013.13UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-azure-fde-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-fde-7.07.0.0-1013.13~24.04.1UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-gcp6.8.0-1071.79UBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-gcp7.0.0-1011.11UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-gcp-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-gcp-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-gke6.8.0-1066.74UBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-gke7.0.0-1006.7UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1052.56UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-hwe-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-31.31~24.04.1UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-ibm6.8.0-1067.68UBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-ibm7.0.0-1013.13UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-ibm-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-147.147.1UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1018.18UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-nvidia-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-nvidia-7.07.0.0-1018.18~24.04.1UBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-nvidia-bos7.0.0-2018.18UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-nvidia-lowlatencyno fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1013.13UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-oracle6.8.0-1064.67UBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-oracle7.0.0-1011.11UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-oracle-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-oracle-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-raspi7.0.0-1019.19UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-realtime7.0.0-31.31.1UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-64377
Ubuntu:26.04:LTSlinux-riscv7.0.0-31.31.1UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-riscv-6.8no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-31.31.1~24.04.1UBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-64377
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-vmware6.8.0-1008.8UBUNTU-CVE-2026-64377
Ubuntu:24.04:LTSlinux-xilinxno fix listedUBUNTU-CVE-2026-64377

Affected products (as reported)

VendorProductVersions
Linux Linux 054a3ef683a176a509cc9b37f762029aae942495 – before 0f012938f21302c08153589c1aca0283f8d6911d054a3ef683a176a509cc9b37f762029aae942495 – before 28a03a3f6e6cda0b0da3b43761d175dec5d14d13054a3ef683a176a509cc9b37f762029aae942495 – before e904961332801c87355f5d11c65bb433e717c489054a3ef683a176a509cc9b37f762029aae942495 – before 9de568ef6cdfc7912d5ea8db02843c0e4ef0c75d054a3ef683a176a509cc9b37f762029aae942495 – before bcb8889c4981fdde42d4fd2c29a77d510fe21da2
Linux Linux 6.2

References