CVE-2026-64420

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mfd: cros_ec: Delay dev_set_drvdata() until probe success<br /> <br /> If ec_device_probe() fails, cros_ec_class_release releases memory for the<br /> cros_ec_dev structure. However, because the drvdata was already set,<br /> sub-drivers like cros_ec_typec can still retrieve the stale pointer via the<br /> platform device. This leads to a use-after-free when cros_ec_typec attempts<br /> to access &amp;typec-&gt;ec-&gt;ec-&gt;dev on a device that has already been released.<br /> Move dev_set_drvdata() to ensure that the pointer is only made available<br /> once all initialization steps have succeeded.<br /> <br /> sysfs: cannot create duplicate filename &amp;#39;/class/chromeos/cros_ec&amp;#39;<br /> Call trace:<br /> sysfs_do_create_link_sd+0x94/0xdc<br /> sysfs_create_link+0x30/0x44<br /> device_add_class_symlinks+0x90/0x13c<br /> device_add+0xf0/0x50c<br /> ec_device_probe+0x150/0x4f0<br /> platform_probe+0xa0/0xe0<br /> ...<br /> BUG: KASAN: invalid-access in __memcpy+0x44/0x230<br /> Write at addr f5ffff809e2d33ac by task kworker/u32:5/125<br /> Pointer tag: [f5], memory tag: [fe]<br /> Tainted : [W]=WARN, [O]=OOT_MODULE<br /> Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3<br /> Workqueue: events_unbound deferred_probe_work_func<br /> Call trace:<br /> __memcpy+0x44/0x230<br /> cros_ec_check_features+0x60/0xcc [cros_ec_proto]<br /> cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]<br /> platform_probe+0xa0/0xe0