Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is… (CVE-2026-64377)
A vulnerability in the Linux kernel's cpufreq subsystem (qcom-cpufreq-hw driver) involved a possible double free of memory that is managed by the device resource management system (devm). The issue arises because the driver incorrectly calls kfree() on memory allocated with devm_kzalloc(), potentially causing a double free when the platform device is detached. This flaw has been fixed by removing the improper kfree() call and allowing devres to manage the memory release. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-31.31 and related builds. A patch is available and should be applied to mitigate the issue.
AI Analysis
Technical Summary
The Linux kernel's cpufreq subsystem for Qualcomm hardware (qcom-cpufreq-hw) had a vulnerability where qcom_cpufreq.data, allocated with devm_kzalloc() as an array, was improperly freed with kfree() in qcom_cpufreq_hw_cpu_exit(). Since devm-managed memory should not be freed manually, this could lead to a double free when the platform device is detached. The fix removes the kfree() call and relies on devres to release the memory correctly. This issue affects multiple Linux kernel versions prior to 7.0.0-31.31 and related variants. The vulnerability has been patched in updated kernel packages as per the Ubuntu security advisories USN-8726-1 and USN-8727-1.
Potential Impact
If exploited, this vulnerability could cause memory corruption due to a double free condition in the kernel, potentially leading to system instability or crashes. However, there is no indication of active exploitation in the wild. The issue is limited to the Qualcomm CPU frequency scaling driver and does not directly imply privilege escalation or remote code execution. The severity is assessed as medium.
Mitigation Recommendations
A patch is available and has been released by Ubuntu as part of their Linux kernel updates. Users should update to the fixed kernel versions listed in the Ubuntu advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required to apply the changes. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. No additional mitigation steps are required beyond applying the official updates.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is… (CVE-2026-64377)
Description
A vulnerability in the Linux kernel's cpufreq subsystem (qcom-cpufreq-hw driver) involved a possible double free of memory that is managed by the device resource management system (devm). The issue arises because the driver incorrectly calls kfree() on memory allocated with devm_kzalloc(), potentially causing a double free when the platform device is detached. This flaw has been fixed by removing the improper kfree() call and allowing devres to manage the memory release. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-31.31 and related builds. A patch is available and should be applied to mitigate the issue.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's cpufreq subsystem for Qualcomm hardware (qcom-cpufreq-hw) had a vulnerability where qcom_cpufreq.data, allocated with devm_kzalloc() as an array, was improperly freed with kfree() in qcom_cpufreq_hw_cpu_exit(). Since devm-managed memory should not be freed manually, this could lead to a double free when the platform device is detached. The fix removes the kfree() call and relies on devres to release the memory correctly. This issue affects multiple Linux kernel versions prior to 7.0.0-31.31 and related variants. The vulnerability has been patched in updated kernel packages as per the Ubuntu security advisories USN-8726-1 and USN-8727-1.
Potential Impact
If exploited, this vulnerability could cause memory corruption due to a double free condition in the kernel, potentially leading to system instability or crashes. However, there is no indication of active exploitation in the wild. The issue is limited to the Qualcomm CPU frequency scaling driver and does not directly imply privilege escalation or remote code execution. The severity is assessed as medium.
Mitigation Recommendations
A patch is available and has been released by Ubuntu as part of their Linux kernel updates. Users should update to the fixed kernel versions listed in the Ubuntu advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required to apply the changes. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. No additional mitigation steps are required beyond applying the official updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9gw4-rc8j-j633
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64377"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420b9c2644c7f8084a38
Added to database: 07/25/2026, 23:08:59 UTC
Last enriched: 09/07/2026, 18:04:15 UTC
Last updated: 09/07/2026, 22:52:14 UTC
Views: 45
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.