CVE-2026-64222

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc3

Description A double free issue exists in the octeontx2-pf driver. The function otx2 pool aq init() frees pool->stack during a mailbox sync or retry allocation failure but does not clear the pointer. Subsequently, otx2 sq aura pool init() triggers otx2 aura pool free(), which frees pool->stack a second time. This same behavior occurs in the cn20k pool aq init() implementation for CN20K hardware.

Recommendations Update the Linux kernel to version 7.1-rc3 or later.