VulnSocial

CVE-2026-64377Disclosure(linux / linux_kernel)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to one element of this array in policy->driver_data. qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data. This is not valid because the memory is devm-managed. For the first domain, this can free the devm-managed allocation while the devres entry is still active, leading to a possible double free when the platform device is later detached. For other domains, the pointer may refer to an element inside the array rather than the allocation base. Remove the kfree(data) call and let devres release qcom_cpufreq.data. This issue was found by a static analysis tool I am developing.

linux CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-415

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • linux_kernel

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-26); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
linux
Products
linux_kernel

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-26: 1Mentions · 2026-08-11: 1Technical Details · 2026-07-26: 107-2608-11
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-261
Disclosure1
2026-08-111
General1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    #CVE-2026-64377 - Double free in #Linux kernel cpufreq driver (qcom-cpufreq-hw). Potential system crash or exploitation. #CVSS 0. No patch yet. Monitor your distro for updates. #infosec #devsecops #devops #developer #sysadmin #git #github #gitlab #docker https://www.valtersit.com/cve/CVE-2026-64377/

    Post summary

    The tweet announces CVE-2026-64377, a double‑free flaw in the Linux kernel cpufreq driver that could cause crashes, with no patch available yet.

    0000163
    995 followersView on X
  • Windows Forum@windowsforum
    General

    🐧 CVE-2026-64377 is a Linux-on-Qualcomm kernel bug, not a Windows flaw. Windows 11 users can stop refreshing Windows Update—this one is for Linux admins, not your PC. https://windowsforum.com/security-alerts.84/cve-2026-64377-affects-qualcomm-linux-not-windows.442322/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #LinuxKernel #CveAnalysis #QualcommCpufreq #DebianSecurity https://t.co/rsuBD9ynC1

    Post summary

    The post simply states that CVE‑2026‑64377 affects Linux on Qualcomm and gives no PoC, exploit details, or patch information.

    0000057
    1.3K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
OSlinuxlinux_kernel---

Explore more

Back to dashboardlinux CVEslinux_kernel vulnerabilities