CVE Explorer

CVE-2026-64420

In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Mov

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3a388567a16a5da9843759cb29318ddfaaa8221f9f7eb980f7147dc7d9d66a93

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mfd/cros_ec_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"les…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mfd/cros_ec_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"24522713034d521ea4b5f5f36342e2b2f7e73bd6","status":"affected","version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","versionType":"git"},{"lessThan":"f7e81dc181d9fe8ab977158042cd193e8cc12091","status":"affected","version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","versionType":"git"},{"lessThan":"257203d83204b192d1265a916b42ca0d499bb117","status":"affected","version":"1c1d152cc5ac3a67d199…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:ff13f209c3a77a00bde01aa828f8d85c57e6bf189b86d73292b0707911c05b41 · sha256:982e7826b7892ee0… · /containers/cna/references/6

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer