CVE-2026-64377 Overview
CVE-2026-64377 is a double free vulnerability in the Linux kernel's Qualcomm cpufreq hardware driver (qcom-cpufreq-hw). The flaw resides in qcom_cpufreq_hw_cpu_exit(), which calls kfree() on memory allocated with devm_kzalloc(). Because devres already tracks and releases this allocation when the platform device detaches, the explicit kfree() produces a double free condition. The issue was reported through a static analysis tool and resolved upstream by removing the redundant kfree(data) call and letting devres release qcom_cpufreq.data.
Critical Impact
A double free in the cpufreq driver can corrupt kernel heap metadata, cause a kernel panic, or be leveraged for local privilege escalation on affected Qualcomm-based Linux systems.
Affected Products
- Linux kernel branches shipping the qcom-cpufreq-hw cpufreq driver
- Qualcomm Snapdragon platforms running affected kernels
- Downstream distributions and Android kernels tracking the affected stable trees
Discovery Timeline
- 2026-07-25 - CVE-2026-64377 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64377
Vulnerability Analysis
The qcom-cpufreq-hw driver allocates qcom_cpufreq.data through devm_kzalloc() inside its probe() function. The allocation is an array containing per-domain data structures. During policy initialization, qcom_cpufreq_hw_cpu_init() stores a pointer to one element of that array into policy->driver_data.
When a policy is removed, qcom_cpufreq_hw_cpu_exit() calls kfree(policy->driver_data). This is unsafe for two distinct reasons. First, memory returned by devm_kzalloc() is managed by the devres framework and must not be released with kfree(). Second, for domains other than the first, policy->driver_data points to an element inside the array rather than to the base of the allocation, so the pointer is not even a valid kfree() argument.
When the platform device later detaches, devres walks its resource list and frees qcom_cpufreq.data again, producing a double free.
Root Cause
The root cause is mismatched memory ownership semantics. devm_kzalloc() allocations are automatically released on device teardown, so drivers must not free them manually. Calling kfree() on a devm-managed pointer, or on an interior pointer into a devm allocation, violates the invariants of both the SLUB allocator and the devres subsystem.
Attack Vector
Triggering the flaw requires the cpufreq policy exit path to run, which occurs during driver unbind, module removal, or platform device detach on Qualcomm hardware. A local user with the ability to unbind the driver, or a hot-remove event on affected hardware, can reach the vulnerable code path. Successful exploitation can crash the kernel or corrupt the slab allocator state used by later allocations.
Because no verified public exploit code has been released, the mechanism is described in prose. See the upstream commits referenced below for the exact patched call site.
Detection Methods for CVE-2026-64377
Indicators of Compromise
- Kernel oops or panic logs referencing qcom_cpufreq_hw_cpu_exit, kfree, or SLUB double free warnings.
- dmesg entries containing strings such as double free or corruption, Object already free, or KASAN: double-free originating from the cpufreq subsystem.
- Unexpected reboots on Qualcomm-based devices following driver unbind, suspend/resume, or CPU hotplug events.
Detection Strategies
- Compare the running kernel version against the fixed commits: 28a03a3f6e6c, 9de568ef6cdf, bcb8889c4981, and e904961332801.
- Enable KASAN and SLUB debugging on test kernels to surface any residual double free paths in the cpufreq driver.
- Collect kernel crash dumps and inspect backtraces for qcom_cpufreq_hw_cpu_exit frames.
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log to a central log store and alert on SLUB corruption or KASAN messages.
- Track platform device bind/unbind events on Qualcomm hardware fleets for anomalous activity.
- Monitor kernel version inventory to confirm patched builds are deployed across affected devices.
How to Mitigate CVE-2026-64377
Immediate Actions Required
- Update to a Linux kernel release that contains the upstream fix removing the kfree(data) call in qcom_cpufreq_hw_cpu_exit().
- On distributions, apply the vendor-supplied kernel package that backports the four referenced stable commits.
- Restrict local access to sysfs unbind interfaces (/sys/bus/platform/drivers/qcom-cpufreq-hw/unbind) to root only, which is the default.
Patch Information
The upstream fix removes the incorrect kfree(policy->driver_data) call in qcom_cpufreq_hw_cpu_exit() and relies on devres to release the devm_kzalloc() allocation when the platform device detaches. The fix is present in the following stable kernel commits: 28a03a3f6e6c, 9de568ef6cdf, bcb8889c4981, and e904961332801.
Workarounds
- Avoid unbinding or removing the qcom-cpufreq-hw driver on unpatched systems, since the vulnerable path only executes during policy teardown.
- If the driver is built as a module, do not run rmmod qcom-cpufreq-hw on production hardware until the patched kernel is installed.
- Enforce least privilege on administrative accounts to prevent untrusted users from triggering driver detach operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
