CVE-2026-43328

A double-free vulnerability exists in the Linux kernel's cpufreq governor initialization code, specifically in the function cpufreq_dbs_governor_init(). When the call to kobject_init_and_add() fails, the error path first invokes kobject_put() on the kobject embedded in the dbs_data structure. This triggers the release callback cpufreq_dbs_data_release(), which frees dbs_data and calls the governor's exit function. Subsequently, the error path attempts to call gov->exit() and kfree(dbs_data) again, resulting in a double free [1].

To exploit this vulnerability, an attacker would need to cause a failure in the kobject registration process, which could be achieved by exhausting system resources or manipulating kernel parameters. The attack requires local access to the system and the ability to trigger the governor initialization error path.

The double free can lead to memory corruption, potentially enabling privilege escalation or a system crash. Given the CVSS score of 7.8, the vulnerability is considered high severity. The Linux kernel has issued a fix in commit da39ee627fd8 [1]. Users are advised to apply the patch or update to a kernel version containing the fix.