CVE-2026-64118 - Vulnerability Details

- qed: fix double free in qed_cxt_tables_alloc()

Description

In the Linux kernel, the following vulnerability has been resolved:

qed: fix double free in qed_cxt_tables_alloc()

If one of the later PF or VF CID bitmap allocations fails,
qed_cid_map_alloc() jumps to cid_map_fail and frees the previously
allocated CID bitmaps before returning an error. qed_cxt_tables_alloc()
then calls qed_cxt_mngr_free(), which invokes qed_cid_map_free()
again.

Fix this by setting each CID bitmap pointer to NULL after bitmap_free()
to avoid double free.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc3.

Runtime reproduction was not attempted because exercising the failing
allocation path requires device-specific setup.

Published: 2026-07-19

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability arises from a double free in the QED driver’s memory allocation routine. When a CID bitmap allocation fails, the driver frees already allocated bitmaps and then frees them again, causing kernel memory corruption. The corruption could potentially crash the kernel or be used to gain elevated privileges on the system.

Affected Systems

Affected systems are Linux kernel releases that include the QED driver with the vulnerable qed_cxt_tables_alloc implementation. Precise version information is not publicly disclosed, so any distribution shipping a kernel that contains this driver build is potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.4 classifies this issue as high severity, and the EPSS score of less than 1 % indicates a low current exploitation probability. The vulnerability is not listed in CISA KEV. The likely attack vector is device‑specific interaction with QED hardware, requiring a failure in CID bitmap allocation to trigger the double‑free. The risk remains moderate, with a potential for kernel crash or privilege escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fe56b9e6a8d957d6a20729d626027f800c17a2da`	affected	< 9fe030719bd083b766602692ee96c8c985798e3c
`fe56b9e6a8d957d6a20729d626027f800c17a2da`	affected	< 06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227
`fe56b9e6a8d957d6a20729d626027f800c17a2da`	affected	< 8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb
`fe56b9e6a8d957d6a20729d626027f800c17a2da`	affected	< 3904b993cc17ec5d7c5d3b57dbd0b775dafb9684
`fe56b9e6a8d957d6a20729d626027f800c17a2da`	affected	< bdf678a273cadbccc347f331ae2e93ff4d14834c
`fe56b9e6a8d957d6a20729d626027f800c17a2da`	affected	< 0e47fc1c9181ae029e0e35a865cbf2adcbae626c
`fe56b9e6a8d957d6a20729d626027f800c17a2da`	affected	< a04c207f0801abdd23a169b5f902a9845059a65a
`fe56b9e6a8d957d6a20729d626027f800c17a2da`	affected	< 2bccfb8476ca5f3548afbd623dc7a6980d4e77de

Linux

affected

Version	Status	Constraints
`4.4`	affected	—
`0`	unaffected	< 4.4
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fe56b9e6a8d957d6a20729d626027f800c17a2da,9fe030719bd083b766602692ee96c8c985798e3c)`	affected	code_commit	—
`[fe56b9e6a8d957d6a20729d626027f800c17a2da,06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227)`	affected	code_commit	—
`[fe56b9e6a8d957d6a20729d626027f800c17a2da,8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb)`	affected	code_commit	—
`[fe56b9e6a8d957d6a20729d626027f800c17a2da,3904b993cc17ec5d7c5d3b57dbd0b775dafb9684)`	affected	code_commit	—
`[fe56b9e6a8d957d6a20729d626027f800c17a2da,bdf678a273cadbccc347f331ae2e93ff4d14834c)`	affected	code_commit	—
`[fe56b9e6a8d957d6a20729d626027f800c17a2da,0e47fc1c9181ae029e0e35a865cbf2adcbae626c)`	affected	code_commit	—
`[fe56b9e6a8d957d6a20729d626027f800c17a2da,a04c207f0801abdd23a169b5f902a9845059a65a)`	affected	code_commit	—
`[fe56b9e6a8d957d6a20729d626027f800c17a2da,2bccfb8476ca5f3548afbd623dc7a6980d4e77de)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.4`	affected	generic	—
`[0,4.4)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains the QED driver fix.
If an immediate kernel update is not possible, disable or block the QED device in system configuration to prevent execution of the vulnerable code.
Monitor system logs for kernel panics or out‑of‑memory events that may indicate memory corruption attempts.

Generated by OpenCVE AI on July 30, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00152.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227
https://git.kernel.org/stable/c/0e47fc1c9181ae029e0e35a865cbf2adcbae626c
https://git.kernel.org/stable/c/2bccfb8476ca5f3548afbd623dc7a6980d4e77de
https://git.kernel.org/stable/c/3904b993cc17ec5d7c5d3b57dbd0b775dafb9684
https://git.kernel.org/stable/c/8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb
https://git.kernel.org/stable/c/9fe030719bd083b766602692ee96c8c985798e3c
https://git.kernel.org/stable/c/a04c207f0801abdd23a169b5f902a9845059a65a
https://git.kernel.org/stable/c/bdf678a273cadbccc347f331ae2e93ff4d14834c
https://lore.kernel.org/linux-cve-announce/2026071924-CVE-2026-64118-bbfe@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64118
https://www.cve.org/CVERecord?id=CVE-2026-64118

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://lore.kernel.org/linux-cve-announce/2026071924-CVE-2026-64118-bbfe@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64118 https://www.cve.org/CVERecord?id=CVE-2026-64118
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qed_cxt_tables_alloc() If one of the later PF or VF CID bitmap allocations fails, qed_cid_map_alloc() jumps to cid_map_fail and frees the previously allocated CID bitmaps before returning an error. qed_cxt_tables_alloc() then calls qed_cxt_mngr_free(), which invokes qed_cid_map_free() again. Fix this by setting each CID bitmap pointer to NULL after bitmap_free() to avoid double free. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime reproduction was not attempted because exercising the failing allocation path requires device-specific setup.
Title		qed: fix double free in qed_cxt_tables_alloc()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227 https://git.kernel.org/stable/c/0e47fc1c9181ae029e0e35a865cbf2adcbae626c https://git.kernel.org/stable/c/2bccfb8476ca5f3548afbd623dc7a6980d4e77de https://git.kernel.org/stable/c/3904b993cc17ec5d7c5d3b57dbd0b775dafb9684 https://git.kernel.org/stable/c/8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb https://git.kernel.org/stable/c/9fe030719bd083b766602692ee96c8c985798e3c https://git.kernel.org/stable/c/a04c207f0801abdd23a169b5f902a9845059a65a https://git.kernel.org/stable/c/bdf678a273cadbccc347f331ae2e93ff4d14834c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:17.643Z

Updated: 2026-08-05T12:39:27.598Z

Reserved: 2026-07-19T07:54:57.035Z

Link: CVE-2026-64118

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64118 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:30:04Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object