CVE-2026-64224

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> octeontx2-pf: fix double free in rvu_rep_rsrc_init()<br /> <br /> rvu_rep_rsrc_init() allocates queue memory before calling<br /> otx2_init_hw_resources(). When hardware resource setup fails,<br /> otx2_init_hw_resources() already unwinds the partially initialized<br /> SQ, CQ, and aura state before returning an error. The representor<br /> error path then calls otx2_free_hw_resources() again and can free<br /> the same resources a second time.<br /> <br /> Fix this by splitting the cleanup labels so that a failure from<br /> otx2_init_hw_resources() only releases queue memory. Keep the<br /> otx2_free_hw_resources() call for failures that happen after<br /> hardware resource initialization completed successfully.<br /> <br /> The bug was first flagged by an experimental analysis tool we are<br /> developing for kernel memory-management bugs while analyzing<br /> v6.13-rc1. The tool is still under development and is not yet publicly<br /> available. Manual inspection confirms that the bug is still<br /> present in v7.1-rc3.<br /> <br /> Runtime validation was not performed because reproducing this path<br /> requires OcteonTX2 representor hardware.