Answer in brief
CVE-2026-64420 records a High severity (CVSS 7.0) vulnerability in mfd: cros_ec: Delay dev_set_drvdata() until probe success. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b <24522713034d521ea4b5f5f36342e2b2f7e73bd6 || >=1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b <f7e81dc181d9fe8ab977158042cd193e8cc12091 || >=1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b <257203d83204b192d1265a916b42ca0d499bb117 || >=1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b <729ae27dc2503a7c1f92da1859efb45da03e4fa0 || >=1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b <ed2941e5db016a0c600b25f1972620e6e223d9fa || >=1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b <b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d || >=1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b <fc030c5b116f668d4ca86dca63742ddbc98d1665 || >=1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b <8b2c1d41bc36c100b38ce5ee6def246c527eaf8a | 24522713034d521ea4b5f5f36342e2b2f7e73bd6, f7e81dc181d9fe8ab977158042cd193e8cc12091, 257203d83204b192d1265a916b42ca0d499bb117, 729ae27dc2503a7c1f92da1859efb45da03e4fa0, ed2941e5db016a0c600b25f1972620e6e223d9fa, b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d, fc030c5b116f668d4ca86dca63742ddbc98d1665, 8b2c1d41bc36c100b38ce5ee6def246c527eaf8a |
| Linux/Linuxgeneric | 4.12 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded. sysfs: cannot create duplicate filename '/class/chromeos/cros_ec' Call trace: sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x44 device_add_class_symlinks+0x90/0x13c device_add+0xf0/0x50c ec_device_probe+0x150/0x4f0 platform_probe+0xa0/0xe0 ... BUG: KASAN: invalid-access in __memcpy+0x44/0x230 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125 Pointer tag: [f5], memory tag: [fe] Tainted : [W]=WARN, [O]=OOT_MODULE Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3 Workqueue: events_unbound deferred_probe_work_func Call trace: __memcpy+0x44/0x230 cros_ec_check_features+0x60/0xcc [cros_ec_proto] cros_typec_probe+0xe8/0x6e0 [cros_ec_typec] platform_probe+0xa0/0xe0
Quoted source text, attributed separately from HOL analysis.