CVE-2026-64420

mfd: cros_ec: Delay dev_set_drvdata() until probe success

State: Published
Severity: 7.0 High
Published: Jul 25, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mfd: cros_ec: Delay dev_set_drvdata() until probe success

If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded.

sysfs: cannot create duplicate filename '/class/chromeos/cros_ec' Call trace: sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x44 device_add_class_symlinks+0x90/0x13c device_add+0xf0/0x50c ec_device_probe+0x150/0x4f0 platform_probe+0xa0/0xe0 ... BUG: KASAN: invalid-access in __memcpy+0x44/0x230 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125 Pointer tag: [f5], memory tag: [fe] Tainted : [W]=WARN, [O]=OOT_MODULE Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3 Workqueue: events_unbound deferred_probe_work_func Call trace: __memcpy+0x44/0x230 cros_ec_check_features+0x60/0xcc [cros_ec_proto] cros_typec_probe+0xe8/0x6e0 [cros_ec_typec] platform_probe+0xa0/0xe0

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before 24522713034d521ea4b5f5f36342e2b2f7e73bd6Affected 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before f7e81dc181d9fe8ab977158042cd193e8cc12091Affected 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before 257203d83204b192d1265a916b42ca0d499bb117Affected 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before 729ae27dc2503a7c1f92da1859efb45da03e4fa0Affected 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before ed2941e5db016a0c600b25f1972620e6e223d9faAffected 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before b5f41d5bf08e7b1b14fa0bd640975e6d78dc006dAffected 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before fc030c5b116f668d4ca86dca63742ddbc98d1665Affected 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before 8b2c1d41bc36c100b38ce5ee6def246c527eaf8aAffected
LinuxLinux	4.12Affected before 4.12Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before 24522713034d521ea4b5f5f36342e2b2f7e73bd6Affected
1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before f7e81dc181d9fe8ab977158042cd193e8cc12091Affected
1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before 257203d83204b192d1265a916b42ca0d499bb117Affected
1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before 729ae27dc2503a7c1f92da1859efb45da03e4fa0Affected
1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before ed2941e5db016a0c600b25f1972620e6e223d9faAffected
1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before b5f41d5bf08e7b1b14fa0bd640975e6d78dc006dAffected
1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before fc030c5b116f668d4ca86dca63742ddbc98d1665Affected
1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b to before 8b2c1d41bc36c100b38ce5ee6def246c527eaf8aAffected

LinuxLinux

4.12Affected
before 4.12Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.