VYPR
← All advisories
High severity7.8NVD Advisory· Published May 8, 2026· Updated Jun 1, 2026

CVE-2026-43328

CVE-2026-43328

Description

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path

When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj).

The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free.

Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

28

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.