CVE-2026-64420

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mfd: cros_ec: Delay dev_set_drvdata() until probe success

If ec_device_probe() fails, cros_ec_class_release releases memory for the

cros_ec_dev structure. However, because the drvdata was already set,

sub-drivers like cros_ec_typec can still retrieve the stale pointer via the

platform device. This leads to a use-after-free when cros_ec_typec attempts

to access &typec->ec->ec->dev on a device that has already been released.

Move dev_set_drvdata() to ensure that the pointer is only made available

once all initialization steps have succeeded.

sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'

Call trace:

sysfs_do_create_link_sd+0x94/0xdc

sysfs_create_link+0x30/0x44

device_add_class_symlinks+0x90/0x13c

device_add+0xf0/0x50c

ec_device_probe+0x150/0x4f0

platform_probe+0xa0/0xe0

...

BUG: KASAN: invalid-access in __memcpy+0x44/0x230

Write at addr f5ffff809e2d33ac by task kworker/u32:5/125

Po

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References