CVE-2026-64420

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Linux kernel within the cros ec multi-function device (mfd) component. If the ec device probe() function fails, the cros ec class release function releases the memory allocated for the cros ec dev structure. However, because the driver data is set prematurely, sub-drivers such as cros ec typec can retrieve a stale pointer via the platform device. This leads to an invalid memory access when cros ec typec attempts to access the dev member of the released structure. The issue is triggered when dev set drvdata() is called before the probe process successfully completes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.