CVE-2026-64420

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64420", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.786Z", "datePublished": "2026-07-25T08:50:59.115Z", "dateUpdated": "2026-10-19T20:38:27.984Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:55:19.958Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: cros_ec: Delay dev_set_drvdata() until probe success\n\nIf ec_device_probe() fails, cros_ec_class_release releases memory for the\ncros_ec_dev structure. However, because the drvdata was already set,\nsub-drivers like cros_ec_typec can still retrieve the stale pointer via the\nplatform device. This leads to a use-after-free when cros_ec_typec attempts\nto access &typec->ec->ec->dev on a device that has already been released.\nMove dev_set_drvdata() to ensure that the pointer is only made available\nonce all initialization steps have succeeded.\n\n sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'\n Call trace:\n sysfs_do_create_link_sd+0x94/0xdc\n sysfs_create_link+0x30/0x44\n device_add_class_symlinks+0x90/0x13c\n device_add+0xf0/0x50c\n ec_device_probe+0x150/0x4f0\n platform_probe+0xa0/0xe0\n ...\n BUG: KASAN: invalid-access in __memcpy+0x44/0x230\n Write at addr f5ffff809e2d33ac by task kworker/u32:5/125\n Pointer tag: [f5], memory tag: [fe]\n Tainted : [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n __memcpy+0x44/0x230\n cros_ec_check_features+0x60/0xcc [cros_ec_proto]\n cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]\n platform_probe+0xa0/0xe0"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF occurs in local platform-device probe work for an internally connected ChromeOS EC and its Type-C child, with no network or USB-peer entry point. Exploitation would require local heap shaping or probe-timing influence.\nAC:H - Exploitation requires EC probe failure, such as a duplicate class name, while the Type-C probe concurrently captures the pointer before driver-core cleanup, followed by useful slab reuse. An unprivileged attacker cannot directly control both sides of this race.\nPR:L - On a device whose firmware topology already produces the failure, no capability check protects the automatic probe path, and an unprivileged local process can attempt heap grooming and timing manipulation. User namespaces cannot directly create or rebind these platform devices, but real-root privileges are not required for that exploitation role.\nUI:N - The kernel automatically enumerates and probes both devices through platform-bus workqueues. No victim action such as opening a file, mounting something, or attaching a peripheral is required.\nS:U - The vulnerable driver and the affected kernel memory share the same operating-system security authority. This is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - The freed object contains kernel pointers and may be replaced by another kmalloc object before stale accesses occur. Exploitable UAF reuse can provide kernel-memory disclosure, so confidentiality impact is High.\nI:H - cros_ec_check_features() can copy an eight-byte EC feature response into the freed object, corrupting any replacement object occupying that slab slot. Heap shaping could turn this write-after-free into control-flow corruption or kernel code execution.\nA:H - The observed write-after-free occurs in a kernel workqueue and can produce an oops or panic. It can also disrupt device initialization or repeatedly prevent a vulnerable system from completing a reliable boot."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mfd/cros_ec_dev.c"], "versions": [{"version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "24522713034d521ea4b5f5f36342e2b2f7e73bd6", "status": "affected", "versionType": "git"}, {"version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "f7e81dc181d9fe8ab977158042cd193e8cc12091", "status": "affected", "versionType": "git"}, {"version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "257203d83204b192d1265a916b42ca0d499bb117", "status": "affected", "versionType": "git"}, {"version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "729ae27dc2503a7c1f92da1859efb45da03e4fa0", "status": "affected", "versionType": "git"}, {"version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "ed2941e5db016a0c600b25f1972620e6e223d9fa", "status": "affected", "versionType": "git"}, {"version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d", "status": "affected", "versionType": "git"}, {"version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "fc030c5b116f668d4ca86dca63742ddbc98d1665", "status": "affected", "versionType": "git"}, {"version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "8b2c1d41bc36c100b38ce5ee6def246c527eaf8a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mfd/cros_ec_dev.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6"}, {"url": "https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091"}, {"url": "https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117"}, {"url": "https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0"}, {"url": "https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa"}, {"url": "https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d"}, {"url": "https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665"}, {"url": "https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a"}], "title": "mfd: cros_ec: Delay dev_set_drvdata() until probe success", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64420", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:40:26.658329Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:38:27.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64420", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:40:26.658329Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:40:27.297Z"}}], "cna": {"title": "mfd: cros_ec: Delay dev_set_drvdata() until probe success", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF occurs in local platform-device probe work for an internally connected ChromeOS EC and its Type-C child, with no network or USB-peer entry point. Exploitation would require local heap shaping or probe-timing influence.\nAC:H - Exploitation requires EC probe failure, such as a duplicate class name, while the Type-C probe concurrently captures the pointer before driver-core cleanup, followed by useful slab reuse. An unprivileged attacker cannot directly control both sides of this race.\nPR:L - On a device whose firmware topology already produces the failure, no capability check protects the automatic probe path, and an unprivileged local process can attempt heap grooming and timing manipulation. User namespaces cannot directly create or rebind these platform devices, but real-root privileges are not required for that exploitation role.\nUI:N - The kernel automatically enumerates and probes both devices through platform-bus workqueues. No victim action such as opening a file, mounting something, or attaching a peripheral is required.\nS:U - The vulnerable driver and the affected kernel memory share the same operating-system security authority. This is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - The freed object contains kernel pointers and may be replaced by another kmalloc object before stale accesses occur. Exploitable UAF reuse can provide kernel-memory disclosure, so confidentiality impact is High.\nI:H - cros_ec_check_features() can copy an eight-byte EC feature response into the freed object, corrupting any replacement object occupying that slab slot. Heap shaping could turn this write-after-free into control-flow corruption or kernel code execution.\nA:H - The observed write-after-free occurs in a kernel workqueue and can produce an oops or panic. It can also disrupt device initialization or repeatedly prevent a vulnerable system from completing a reliable boot."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "24522713034d521ea4b5f5f36342e2b2f7e73bd6", "versionType": "git"}, {"status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "f7e81dc181d9fe8ab977158042cd193e8cc12091", "versionType": "git"}, {"status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "257203d83204b192d1265a916b42ca0d499bb117", "versionType": "git"}, {"status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "729ae27dc2503a7c1f92da1859efb45da03e4fa0", "versionType": "git"}, {"status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "ed2941e5db016a0c600b25f1972620e6e223d9fa", "versionType": "git"}, {"status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d", "versionType": "git"}, {"status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "fc030c5b116f668d4ca86dca63742ddbc98d1665", "versionType": "git"}, {"status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "lessThan": "8b2c1d41bc36c100b38ce5ee6def246c527eaf8a", "versionType": "git"}], "programFiles": ["drivers/mfd/cros_ec_dev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"status": "unaffected", "version": "0", "lessThan": "4.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.96", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.39", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/mfd/cros_ec_dev.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6"}, {"url": "https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091"}, {"url": "https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117"}, {"url": "https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0"}, {"url": "https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa"}, {"url": "https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d"}, {"url": "https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665"}, {"url": "https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: cros_ec: Delay dev_set_drvdata() until probe success\n\nIf ec_device_probe() fails, cros_ec_class_release releases memory for the\ncros_ec_dev structure. However, because the drvdata was already set,\nsub-drivers like cros_ec_typec can still retrieve the stale pointer via the\nplatform device. This leads to a use-after-free when cros_ec_typec attempts\nto access &typec->ec->ec->dev on a device that has already been released.\nMove dev_set_drvdata() to ensure that the pointer is only made available\nonce all initialization steps have succeeded.\n\n sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'\n Call trace:\n sysfs_do_create_link_sd+0x94/0xdc\n sysfs_create_link+0x30/0x44\n device_add_class_symlinks+0x90/0x13c\n device_add+0xf0/0x50c\n ec_device_probe+0x150/0x4f0\n platform_probe+0xa0/0xe0\n ...\n BUG: KASAN: invalid-access in __memcpy+0x44/0x230\n Write at addr f5ffff809e2d33ac by task kworker/u32:5/125\n Pointer tag: [f5], memory tag: [fe]\n Tainted : [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n __memcpy+0x44/0x230\n cros_ec_check_features+0x60/0xcc [cros_ec_proto]\n cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]\n platform_probe+0xa0/0xe0"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.96", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.39", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.4", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:55:19.958Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64420", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:38:27.984Z", "dateReserved": "2026-07-19T15:36:31.786Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-25T08:50:59.115Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/mfd/cros_ec_dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "24522713034d521ea4b5f5f36342e2b2f7e73bd6", "status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "versionType": "git"}, {"lessThan": "f7e81dc181d9fe8ab977158042cd193e8cc12091", "status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "versionType": "git"}, {"lessThan": "257203d83204b192d1265a916b42ca0d499bb117", "status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "versionType": "git"}, {"lessThan": "729ae27dc2503a7c1f92da1859efb45da03e4fa0", "status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "versionType": "git"}, {"lessThan": "ed2941e5db016a0c600b25f1972620e6e223d9fa", "status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "versionType": "git"}, {"lessThan": "b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d", "status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "versionType": "git"}, {"lessThan": "fc030c5b116f668d4ca86dca63742ddbc98d1665", "status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "versionType": "git"}, {"lessThan": "8b2c1d41bc36c100b38ce5ee6def246c527eaf8a", "status": "affected", "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/mfd/cros_ec_dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DE5A9A76-6531-4A35-9E92-9AAD00D98589", "versionEndExcluding": "5.10.261", "versionStartIncluding": "4.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6", "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20", "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE", "versionEndExcluding": "6.6.145", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: cros_ec: Delay dev_set_drvdata() until probe success\n\nIf ec_device_probe() fails, cros_ec_class_release releases memory for the\ncros_ec_dev structure. However, because the drvdata was already set,\nsub-drivers like cros_ec_typec can still retrieve the stale pointer via the\nplatform device. This leads to a use-after-free when cros_ec_typec attempts\nto access &typec->ec->ec->dev on a device that has already been released.\nMove dev_set_drvdata() to ensure that the pointer is only made available\nonce all initialization steps have succeeded.\n\n sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'\n Call trace:\n sysfs_do_create_link_sd+0x94/0xdc\n sysfs_create_link+0x30/0x44\n device_add_class_symlinks+0x90/0x13c\n device_add+0xf0/0x50c\n ec_device_probe+0x150/0x4f0\n platform_probe+0xa0/0xe0\n ...\n BUG: KASAN: invalid-access in __memcpy+0x44/0x230\n Write at addr f5ffff809e2d33ac by task kworker/u32:5/125\n Pointer tag: [f5], memory tag: [fe]\n Tainted : [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n __memcpy+0x44/0x230\n cros_ec_check_features+0x60/0xcc [cros_ec_proto]\n cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]\n platform_probe+0xa0/0xe0"}], "id": "CVE-2026-64420", "lastModified": "2026-10-19T21:17:36.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64420", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:40:26.658329Z", "version": "2.0.3"}}]}, "published": "2026-07-25T10:17:25.963", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: mfd: cros_ec: Delay dev_set_drvdata() until probe success", "id": "2507139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507139"}, "csaw": false, "details": ["A flaw was found in the Linux kernel's `cros_ec` driver. This vulnerability, a use-after-free, occurs when the device's data pointer is set too early during initialization. If the initialization process fails, the memory for the `cros_ec_dev` structure is released, but other kernel components, such as the `cros_ec_typec` driver, may still attempt to access the freed memory using a stale pointer. This can lead to an invalid memory access, resulting in a system crash and a denial of service."], "name": "CVE-2026-64420", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64420\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64420\nhttps://lore.kernel.org/linux-cve-announce/2026072534-CVE-2026-64420-296c@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,24522713034d521ea4b5f5f36342e2b2f7e73bd6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,f7e81dc181d9fe8ab977158042cd193e8cc12091)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,257203d83204b192d1265a916b42ca0d499bb117)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,729ae27dc2503a7c1f92da1859efb45da03e4fa0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,ed2941e5db016a0c600b25f1972620e6e223d9fa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,fc030c5b116f668d4ca86dca63742ddbc98d1665)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,8b2c1d41bc36c100b38ce5ee6def246c527eaf8a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T18:30:17.014607+00:00", "title": "Use\u2011After\u2011Free in Chrome OS Cros EC Driver", "updated": "2026-10-20T14:00:16.560390+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}