{"id":"CVE-2026-64224","title":"octeontx2-pf: fix double free in rvu_rep_rsrc_init()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: fix double free in rvu_rep_rsrc_init()\n\nrvu_rep_rsrc_init() allocates queue memory before calling\notx2_init_hw_resources(). When hardware resource setup f…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a < 8864b664d0443ecb8e56690e5546fcda5fe5e81b","Linux >= 3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a < eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad","Linux >= 3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a < e8fb3de2a8effcaf62bec2c56b93d8bb480371d1","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:32:24.902818Z"},"published":"2026-07-24","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:30.404Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64224","references":[{"url":"https://git.kernel.org/stable/c/8864b664d0443ecb8e56690e5546fcda5fe5e81b"},{"url":"https://git.kernel.org/stable/c/eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad"},{"url":"https://git.kernel.org/stable/c/e8fb3de2a8effcaf62bec2c56b93d8bb480371d1"}],"tags":["cve.org"],"epss":0.00128,"epssPercentile":0.0244,"ingestedAt":"2026-11-06T16:57:43.219Z","slug":"CVE-2026-64224","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: fix double free in rvu_rep_rsrc_init()\n\nrvu_rep_rsrc_init() allocates queue memory before calling\notx2_init_hw_resources(). When hardware resource setup fails,\notx2_init_hw_resources() already unwinds the partially initialized\nSQ, CQ, and aura state before returning an error. The representor\nerror path then calls otx2_free_hw_resources() again and can free\nthe same resources a second time.\n\nFix this by splitting the cleanup labels so that a failure from\notx2_init_hw_resources() only releases queue memory. Keep the\notx2_free_hw_resources() call for failures that happen after\nhardware resource initialization completed successfully.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1-rc3.\n\nRuntime validation was not performed because reproducing this path\nrequires OcteonTX2 representor hardware.\n\n## Affected\n\n- `Linux >= 3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a < 8864b664d0443ecb8e56690e5546fcda5fe5e81b`\n- `Linux >= 3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a < eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad`\n- `Linux >= 3937b7308d4fce2793fa7fa56ed0faf0f8b6dc7a < e8fb3de2a8effcaf62bec2c56b93d8bb480371d1`\n- `Linux 6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}