CVE-2026-64599

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crypto: amlogic - avoid double cleanup in meson_crypto_probe()

When meson_allocate_chanlist() fails after a partial allocation, it already

unwinds the allocated chanlist state through its local error path.

meson_crypto_probe() then jump to error_flow and calls

meson_free_chanlist() again, causing the same per-flow resources to be torn

down twice. In the reproduced failure path, the second teardown

re-entered crypto_engine_exit() on an already destroyed worker and KASAN

reported a slab-use-after-free in kthread_destroy_worker().

Prevent double-free by handling partial allocation failures locally within

meson_allocate_chanlist() and skipping the outer cleanup path.

The bug was first flagged by an experimental analysis tool we are

developing for kernel memory-management bugs while analyzing

v6.13-rc1. The tool is still under development and is not yet publicly

available.

The bug was reproduced in a QEMU x86_64 guest

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References