CVE-2026-64377

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double free issue exists in the qcom-cpufreq-hw component. The qcom cpufreq.data is allocated using devm kzalloc() in the probe() function as an array of per-domain data, and qcom cpufreq hw cpu init() stores a pointer to an element of this array in policy->driver data. The qcom cpufreq hw cpu exit() function incorrectly calls kfree() on policy->driver data. Since the memory is devm-managed, this can lead to a double free when the platform device is detached for the first domain, or an invalid free for other domains where the pointer refers to an element inside the array rather than the allocation base.

Recommendations Remove the kfree(data) call within the qcom cpufreq hw cpu exit() function to allow devres to handle the release of qcom cpufreq.data.