CVE-2026-64222 Overview
CVE-2026-64222 is a double free vulnerability in the Linux kernel's octeontx2-pf network driver. The flaw resides in the otx2_pool_aq_init() function, which frees pool->stack when mailbox synchronization or retry allocation fails but leaves the freed pointer unchanged. A subsequent call to otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees the same pool->stack a second time. The CN20K-specific cn20k_pool_aq_init() implementation contains an identical bug in its error path. Exploitation requires local access to a system with OcteonTX2 or CN20K hardware.
Critical Impact
A local attacker with low privileges can trigger memory corruption in the kernel via the double free condition, leading to potential privilege escalation, denial of service, or arbitrary code execution in kernel context.
Affected Products
- Linux kernel (mainline through v7.1-rc3, confirmed present in v6.13-rc1)
- Systems using the octeontx2-pf driver on Marvell OcteonTX2 hardware
- Systems using the CN20K-specific cn20k_pool_aq_init() code path
Discovery Timeline
- 2026-07-24 - CVE-2026-64222 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64222
Vulnerability Analysis
The vulnerability is a double free condition in the octeontx2-pf network driver used with Marvell OcteonTX2 and CN20K network adapters. When otx2_pool_aq_init() encounters a failure during mailbox sync or during retry allocation, it correctly frees the pool->stack allocation. However, the function fails to nullify the pool->stack pointer after freeing.
The caller otx2_sq_aura_pool_init() treats this failure as a partial setup and invokes otx2_aura_pool_free() to unwind allocated resources. This cleanup routine iterates over pools and frees pool->stack again, operating on the dangling pointer left behind by the first free. The identical logic error exists in cn20k_pool_aq_init() for CN20K-specific hardware paths.
Double free conditions in kernel context can corrupt slab allocator metadata, enabling use-after-free scenarios that skilled attackers may leverage for arbitrary kernel memory writes.
Root Cause
The root cause is an incomplete error-handling pattern. The local free path in otx2_pool_aq_init() and cn20k_pool_aq_init() releases memory but does not clear the pointer. The shared cleanup path in otx2_aura_pool_free() then frees the same memory again while cleaning up partially initialized pool state. The fix sets pool->stack to NULL immediately after the local free, ensuring the shared cleanup path skips the already-freed allocation.
Attack Vector
Exploitation requires local access with low privileges on a host running the vulnerable driver against OcteonTX2 or CN20K hardware. The attacker must trigger the failure path in otx2_pool_aq_init() or cn20k_pool_aq_init(), typically by inducing mailbox synchronization errors or resource pressure during network queue initialization. Runtime validation of the flaw was not performed by the reporter because reproducing the path requires physical OcteonTX2 or CN20K hardware.
No public exploit code, proof of concept, or in-the-wild exploitation has been reported. See the upstream fix in Kernel.org Commit 0488a0b for the technical details of the patch.
Detection Methods for CVE-2026-64222
Indicators of Compromise
- Kernel panic messages or oops output referencing otx2_pool_aq_init, cn20k_pool_aq_init, or otx2_aura_pool_free in the call trace.
- SLUB or KASAN reports of double-free or use-after-free events on kernels compiled with memory sanitizers enabled.
- Unexpected network interface initialization failures on OcteonTX2 or CN20K adapters, followed by kernel instability.
Detection Strategies
- Inventory Linux hosts running kernels between v6.13-rc1 and v7.1-rc3 and identify systems using Marvell OcteonTX2 or CN20K network hardware via lspci and lsmod | grep octeontx2.
- Enable KASAN and SLUB debugging on test kernels to catch double-free events during driver initialization stress tests.
- Correlate driver initialization failures with subsequent kernel crashes in centralized logging platforms.
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log output to a centralized log store and alert on stack traces containing the vulnerable function names.
- Monitor kernel version and driver module hashes across fleet inventory to identify unpatched hosts.
- Track mailbox synchronization failures on OcteonTX2/CN20K adapters, since these are the trigger condition for the double free.
How to Mitigate CVE-2026-64222
Immediate Actions Required
- Identify all hosts running affected kernel versions with OcteonTX2 or CN20K hardware in use.
- Apply the upstream stable kernel patches referenced below or upgrade to a distribution kernel that includes the fix.
- Restrict local shell access on affected hosts to trusted administrators until patches are applied.
Patch Information
The upstream fix sets pool->stack to NULL immediately after the local free in both otx2_pool_aq_init() and cn20k_pool_aq_init(), preventing the shared cleanup path from freeing the same allocation a second time. Multiple stable branch patches are available: Kernel.org Commit 0488a0b, Kernel.org Commit 0d9b9d7d, Kernel.org Commit 4c29603, Kernel.org Commit 94192b05, Kernel.org Commit 9b244c24, Kernel.org Commit b92e7ea4, Kernel.org Commit c4b8c5d5, and Kernel.org Commit e6e9bc0b.
Workarounds
- Where operationally feasible, unload the octeontx2-pf driver on hosts that do not require OcteonTX2 or CN20K networking.
- Blacklist the driver module on non-production or unaffected systems to reduce attack surface until patching completes.
- Enforce least privilege on local accounts to limit the population able to trigger driver initialization paths.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
