SECUFOCUSNOW
Home›CVE index›CVE-2026-64420
Review reviewHigh

CVE-2026-64420

Linux

In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps...

CVSS
7
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps...

Affected product and versions

Product
Linux
Affected versions
>= 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b < 24522713034d521ea4b5f5f36342e2b2f7e73bd6, >= 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b < f7e81dc181d9fe8ab977158042cd193e8cc12091, >= 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b < 257203d83204b192d1265a916b42ca0d499bb117, >= 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b < 729ae27dc2503a7c1f92da1859efb45da03e4fa0, >= 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b < ed2941e5db016a0c600b25f1972620e6e223d9fa, >= 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b < b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d, >= 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b < fc030c5b116f668d4ca86dca63742ddbc98d1665, >= 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b < 8b2c1d41bc36c100b38ce5ee6def246c527eaf8a, >= 4.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available