CVE-2026-64377

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cpufreq: qcom-cpufreq-hw: Fix possible double free<br /> <br /> qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an<br /> array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to<br /> one element of this array in policy-&gt;driver_data.<br /> <br /> qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy-&gt;driver_data.<br /> This is not valid because the memory is devm-managed. For the first<br /> domain, this can free the devm-managed allocation while the devres entry<br /> is still active, leading to a possible double free when the platform<br /> device is later detached. For other domains, the pointer may refer to an<br /> element inside the array rather than the allocation base.<br /> <br /> Remove the kfree(data) call and let devres release qcom_cpufreq.data.<br /> <br /> This issue was found by a static analysis tool I am developing.