CVE-2026-64420 - Vulnerability Details

- mfd: cros_ec: Delay dev_set_drvdata() until probe success

Description

In the Linux kernel, the following vulnerability has been resolved:

mfd: cros_ec: Delay dev_set_drvdata() until probe success

If ec_device_probe() fails, cros_ec_class_release releases memory for the
cros_ec_dev structure. However, because the drvdata was already set,
sub-drivers like cros_ec_typec can still retrieve the stale pointer via the
platform device. This leads to a use-after-free when cros_ec_typec attempts
to access &typec->ec->ec->dev on a device that has already been released.
Move dev_set_drvdata() to ensure that the pointer is only made available
once all initialization steps have succeeded.

sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'
Call trace:
sysfs_do_create_link_sd+0x94/0xdc
sysfs_create_link+0x30/0x44
device_add_class_symlinks+0x90/0x13c
device_add+0xf0/0x50c
ec_device_probe+0x150/0x4f0
platform_probe+0xa0/0xe0
...
BUG: KASAN: invalid-access in __memcpy+0x44/0x230
Write at addr f5ffff809e2d33ac by task kworker/u32:5/125
Pointer tag: [f5], memory tag: [fe]
Tainted : [W]=WARN, [O]=OOT_MODULE
Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3
Workqueue: events_unbound deferred_probe_work_func
Call trace:
__memcpy+0x44/0x230
cros_ec_check_features+0x60/0xcc [cros_ec_proto]
cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]
platform_probe+0xa0/0xe0

Published: 2026-07-25

Score: 7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Chrome OS cros_ec driver assigns a pointer to its platform device before confirming that initialization has fully succeeded; if the probe fails, the driver data remains registered, allowing a sub‑driver such as cros_ec_typec to later dereference the stale pointer, which produces a use‑after‑free that can corrupt kernel memory or trigger a crash.

Affected Systems

Any Linux kernel build that includes the cros_ec and related cros_ec_typec modules, which are commonly loaded in Chrome OS hardware, is affected; systems that load these modules during boot or from a module load before the patch will be vulnerable.

Risk and Exploitability

The CVSS score of 7 indicates a medium‑high severity, while the EPSS score of less than 1% signifies a very low likelihood of exploitation; the vulnerability is not listed in CISA KEV, and based on the description it is inferred that exploitation would require local access to trigger a probe failure or manipulate the device initialization sequence, making remote exploitation unlikely.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b`	affected	< 24522713034d521ea4b5f5f36342e2b2f7e73bd6
`1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b`	affected	< f7e81dc181d9fe8ab977158042cd193e8cc12091
`1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b`	affected	< 257203d83204b192d1265a916b42ca0d499bb117
`1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b`	affected	< 729ae27dc2503a7c1f92da1859efb45da03e4fa0
`1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b`	affected	< ed2941e5db016a0c600b25f1972620e6e223d9fa
`1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b`	affected	< b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d
`1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b`	affected	< fc030c5b116f668d4ca86dca63742ddbc98d1665
`1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b`	affected	< 8b2c1d41bc36c100b38ce5ee6def246c527eaf8a

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,24522713034d521ea4b5f5f36342e2b2f7e73bd6)`	affected	code_commit	—
`[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,f7e81dc181d9fe8ab977158042cd193e8cc12091)`	affected	code_commit	—
`[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,257203d83204b192d1265a916b42ca0d499bb117)`	affected	code_commit	—
`[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,729ae27dc2503a7c1f92da1859efb45da03e4fa0)`	affected	code_commit	—
`[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,ed2941e5db016a0c600b25f1972620e6e223d9fa)`	affected	code_commit	—
`[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d)`	affected	code_commit	—
`[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,fc030c5b116f668d4ca86dca63742ddbc98d1665)`	affected	code_commit	—
`[1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b,8b2c1d41bc36c100b38ce5ee6def246c527eaf8a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.12`	affected	generic	—
`[0,4.12)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that implements the patch which defers dev_set_drvdata until after a successful probe.
If an immediate kernel upgrade is unavailable, blacklist or unload the cros_ec and cros_ec_typec modules so the vulnerable code never runs.
Enable kernel hardening features such as STACKPROTECTOR, address space layout randomization, and enforce SELinux or AppArmor confinement to reduce the impact while remediation is pending.

Generated by OpenCVE AI on October 20, 2026 at 13:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00119.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6
https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117
https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0
https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a
https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d
https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa
https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091
https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665
https://lore.kernel.org/linux-cve-announce/2026072534-CVE-2026-64420-296c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64420
https://www.cve.org/CVERecord?id=CVE-2026-64420

History

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 03 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 30 Jul 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072534-CVE-2026-64420-296c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64420 https://www.cve.org/CVERecord?id=CVE-2026-64420

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded. sysfs: cannot create duplicate filename '/class/chromeos/cros_ec' Call trace: sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x44 device_add_class_symlinks+0x90/0x13c device_add+0xf0/0x50c ec_device_probe+0x150/0x4f0 platform_probe+0xa0/0xe0 ... BUG: KASAN: invalid-access in __memcpy+0x44/0x230 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125 Pointer tag: [f5], memory tag: [fe] Tainted : [W]=WARN, [O]=OOT_MODULE Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3 Workqueue: events_unbound deferred_probe_work_func Call trace: __memcpy+0x44/0x230 cros_ec_check_features+0x60/0xcc [cros_ec_proto] cros_typec_probe+0xe8/0x6e0 [cros_ec_typec] platform_probe+0xa0/0xe0
Title		mfd: cros_ec: Delay dev_set_drvdata() until probe success
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6 https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117 https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0 https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091 https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:59.115Z

Updated: 2026-10-19T20:38:27.984Z

Reserved: 2026-07-19T15:36:31.786Z

Link: CVE-2026-64420

Vulnrichment

Updated: 2026-10-16T15:40:27.297Z

NVD

Status : Modified

Published: 2026-07-25T10:17:25.963

Modified: 2026-10-19T21:17:36.897

Link: CVE-2026-64420

Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64420 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T14:00:16Z

Weaknesses

CWE-416
Use After Free
CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object