VulnerabilityPublished 24 Jul 2026Updated 6 Nov 2026

CVE-2026-64224: Linux kernel · octeontx2-pf: fix double free in rvu_rep_rsrc_init()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:52 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad, e8fb3de2a8effcaf62bec2c56b93d8bb480371d1, 8864b664d0443ecb8e56690e5546fcda5fe5e81b

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad, e8fb3de2a8effcaf62bec2c56b93d8bb480371d1 or 8864b664d0443ecb8e56690e5546fcda5fe5e81b.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a, < eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad	Fixed in eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad
LinuxLinux	Affected ≥ 3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a, < e8fb3de2a8effcaf62bec2c56b93d8bb480371d1	Fixed in e8fb3de2a8effcaf62bec2c56b93d8bb480371d1
LinuxLinux	Affected ≥ 3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a, < 8864b664d0443ecb8e56690e5546fcda5fe5e81b	Fixed in 8864b664d0443ecb8e56690e5546fcda5fe5e81b
LinuxLinux	Affected =6.13	Fixed in–

AI-suggested

A fix is available in the Linux kernel source code as indicated by the fixed commit versions (eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad, e8fb3de2a8effcaf62bec2c56b93d8bb480371d1, 8864b664d0443ecb8e56690e5546fcda5fe5e81b). Users should update to a kernel version including these fixes. No additional mitigation steps are specified or required by the vendor advisory.

Description

A double free vulnerability was identified and fixed in the Linux kernel's octeontx2-pf driver within the rvu_rep_rsrc_init() function. The issue arises when hardware resource setup fails, causing the same memory resources to be freed twice due to improper cleanup sequencing. This bug was detected through experimental analysis tools and manual inspection, affecting Linux kernel version 6.13. The fix involves adjusting cleanup logic to prevent double freeing of resources.

Impact

The vulnerability can cause a double free condition in kernel memory management, which may lead to undefined behavior such as kernel crashes or potential memory corruption. However, exploitation details or active exploitation in the wild are not reported. The impact is limited to systems running the affected Linux kernel version with the octeontx2-pf driver and specific hardware.

Summary

In the Linux kernel octeontx2-pf driver, rvu_rep_rsrc_init() allocates queue memory before calling otx2_init_hw_resources(). If otx2_init_hw_resources() fails during hardware resource setup, it unwinds partially initialized resources. However, the error path then calls otx2_free_hw_resources() again, leading to a double free of the same resources. The patch splits cleanup labels so that failures in otx2_init_hw_resources() only release queue memory, while otx2_free_hw_resources() is called only after successful hardware resource initialization. The vulnerability was found by an experimental kernel memory-management analysis tool and confirmed manually. It affects Linux kernel version 6.13 and remains present in v7.1-rc3 without runtime validation due to hardware requirements.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 16:52 UTC

Technical details

References

Community reviews

Related threats