{"id":"CVE-2026-64420","revision":"1cc15a15581041c28dcee377fd35e243","records":[{"revision":"1cc15a15581041c28dcee377fd35e243","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64420","aliases":[],"title":"mfd: cros_ec: Delay dev_set_drvdata() until probe success","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: cros_ec: Delay dev_set_drvdata() until probe success\n\nIf ec_device_probe() fails, cros_ec_class_release releases memory for the\ncros_ec_dev structure. However, because the drvdata was already set,\nsub-drivers like cros_ec_typec can still retrieve the stale pointer via the\nplatform device. This leads to a use-after-free when cros_ec_typec attempts\nto access &typec->ec->ec->dev on a device that has already been released.\nMove dev_set_drvdata() to ensure that the pointer is only made available\nonce all initialization steps have succeeded.\n\n sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'\n Call trace:\n  sysfs_do_create_link_sd+0x94/0xdc\n  sysfs_create_link+0x30/0x44\n  device_add_class_symlinks+0x90/0x13c\n  device_add+0xf0/0x50c\n  ec_device_probe+0x150/0x4f0\n  platform_probe+0xa0/0xe0\n ...\n BUG: KASAN: invalid-access in __memcpy+0x44/0x230\n Write at addr f5ffff809e2d33ac by task kworker/u32:5/125\n Pointer tag: [f5], memory tag: [fe]\n Tainted : [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n  __memcpy+0x44/0x230\n  cros_ec_check_features+0x60/0xcc [cros_ec_proto]\n  cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]\n  platform_probe+0xa0/0xe0","state":0,"publishedAt":"2026-07-25T08:50:59.115+00:00","modifiedAt":"2026-10-19T20:38:27.984+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/mfd/cros_ec_dev.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\n                            \"lessThan\": \"24522713034d521ea4b5f5f36342e2b2f7e73bd6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\n                            \"lessThan\": \"f7e81dc181d9fe8ab977158042cd193e8cc12091\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\n                            \"lessThan\": \"257203d83204b192d1265a916b42ca0d499bb117\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\n                            \"lessThan\": \"729ae27dc2503a7c1f92da1859efb45da03e4fa0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\n                            \"lessThan\": \"ed2941e5db016a0c600b25f1972620e6e223d9fa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\n                            \"lessThan\": \"b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\n                            \"lessThan\": \"fc030c5b116f668d4ca86dca63742ddbc98d1665\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\n                            \"lessThan\": \"8b2c1d41bc36c100b38ce5ee6def246c527eaf8a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/mfd/cros_ec_dev.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.96\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.39\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.4\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6","https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091","https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117","https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0","https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa","https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d","https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665","https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64420","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64420","identifiers":["CVE-2026-64420"]},"retained":false,"historicalAffected":[]}],"coverage":[]}