High 7.0Published Jul 25, 2026

CVE-2026-64420mfd: cros_ec: Delay dev_set_drvdata() until probe success

Updated under an hour ago (2026-10-19 09:10 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded. sysfs: cannot create duplicate filename '/class/chromeos/cros_ec' Call trace: sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x44 device_add_class_symlinks+0x90/0x13c device_add+0xf0/0x50c ec_device_probe+0x150/0x4f0 platform_probe+0xa0/0xe0 ... BUG: KASAN: invalid-access in __memcpy+0x44/0x230 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125 Pointer tag: [f5], memory tag: [fe] Tainted : [W]=WARN, [O]=OOT_MODULE Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3 Workqueue: events_unbound deferred_probe_work_func Call trace: __memcpy+0x44/0x230 cros_ec_check_features+0x60/0xcc [cros_ec_proto] cros_typec_probe+0xe8/0x6e0 [cros_ec_typec] platform_probe+0xa0/0xe0

CVSS: 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b before 24522713034d521ea4b5f5f36342e2b2f7e73bd6; from 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b before f7e81dc181d9fe8ab977158042cd193e8cc12091; from 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b before 257203d83204b192d1265a916b42ca0d499bb117; from 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b before 729ae27dc2503a7c1f92da1859efb45da03e4fa0; from 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b before ed2941e5db016a0c600b25f1972620e6e223d9fa; from 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b before b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d; from 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b before fc030c5b116f668d4ca86dca63742ddbc98d1665; from 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b before 8b2c1d41bc36c100b38ce5ee6def246c527eaf8a	CNA record
linux linux_kernel linux:linux_kernel	from 4.12 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4	NVD

References

https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6patch
https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091patch
https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117patch
https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0patch
https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fapatch
https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006dpatch
https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665patch
https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8apatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.