---
id: CVE-2026-64377
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cpufreq: qcom-cpufreq-hw: Fix possible double free

  qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an
  array of per-domain data
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cpufreq: qcom-cpufreq-hw: Fix possible double free

  qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an
  array of per-domain data. qcom_cpufreq_hw_cpu_in…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-415
  - CWE-763
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.2, < 6.12.96'
  - 'linux_kernel >= 6.13, < 6.18.39'
  - 'linux_kernel >= 6.19, < 7.1.4'
patched:
  - linux_kernel 7.1.4
published: '2026-07-25'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T14:20:18.577'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64377'
references:
  - url: 'https://git.kernel.org/stable/c/28a03a3f6e6cda0b0da3b43761d175dec5d14d13'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9de568ef6cdfc7912d5ea8db02843c0e4ef0c75d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bcb8889c4981fdde42d4fd2c29a77d510fe21da2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e904961332801c87355f5d11c65bb433e717c489'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64377.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64377'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507265'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64377'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64377'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026072524-CVE-2026-64377-8fef@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00129
epssPercentile: 0.02068
ingestedAt: '2026-09-08T15:33:26.948Z'
scores:
  nvd: 7.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: qcom-cpufreq-hw: Fix possible double free

qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an
array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to
one element of this array in policy->driver_data.

qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data.
This is not valid because the memory is devm-managed. For the first
domain, this can free the devm-managed allocation while the devres entry
is still active, leading to a possible double free when the platform
device is later detached. For other domains, the pointer may refer to an
element inside the array rather than the allocation base.

Remove the kfree(data) call and let devres release qcom_cpufreq.data.

This issue was found by a static analysis tool I am developing.

## Affected

- `linux_kernel >= 6.2, < 6.12.96`
- `linux_kernel >= 6.13, < 6.18.39`
- `linux_kernel >= 6.19, < 7.1.4`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.1.4`

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64377.json)