KernelScan.io

HIGH

cpufreq Governor DoubleFree

CVE-2026-43328

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI5.8MEDIUM

01

In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release().

02

Engine v0.2.0

Risk summary

A double free vulnerability in the cpufreq governor initialization error path can cause kernel memory corruption and system crashes. This affects systems where privileged processes modify CPU frequency scaling policies and encounter initialization failures.

Affecteddrivers/cpufreq/cpufreq_governor.c (cpufreq)

Vulnerability analysis

The vulnerability occurs when kobject_init_and_add() fails during cpufreq governor initialization. The error path calls kobject_put() which triggers a release callback that frees the dbs_data structure, but then the error handling code attempts to free the same structure again. The fix restructures the error path to let kobject_put() handle all cleanup through the release callback, avoiding the duplicate free operations. This requires root privileges to trigger through cpufreq policy operations.

03

BranchFixed inPatch commit
5.105.10.2534b9118e93d24
5.155.15.209019ea2862972
5.25.256bc91ee78ba
6.16.1.168da39ee627fd8
6.126.12.81d2703b4f8fb7
6.186.18.223bf9d023d232
6.196.19.126dcf9d0064ce
6.66.6.134427d048e4f6a
mainline7.0