---
id: CVE-2026-43328
title: 'cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path

  When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls
  kobject_put(&dbs_data…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee <
    56bc91ee78babe9578585a2bc137abc4b3115ff3
  - >-
    Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee <
    4b9118e93d2499bb2808ef3742fa0ce06f4f8117
  - >-
    Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee <
    019ea28629720c220daedf38107c8787f330dc05
  - >-
    Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee <
    da39ee627fd82b52068d4d5f115749a8b7d271f9
  - >-
    Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee <
    427d048e4f6acbfa01b5a8062449fe0ee8987c0d
  - >-
    Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee <
    d2703b4f8fb7cc6f0dfdb2dc2359cc46189e7357
  - >-
    Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee <
    3bf9d023d2329a0e5379f2fd09d06ef09729cd9d
  - >-
    Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee <
    6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e
  - Linux e977b1477a6725868302957e6b5c330220391797
  - Linux >= 5.1.6 < 5.2
  - Linux 5.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:35:53.949941Z'
published: '2026-05-08'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:49.314Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43328'
references:
  - url: 'https://git.kernel.org/stable/c/56bc91ee78babe9578585a2bc137abc4b3115ff3'
  - url: 'https://git.kernel.org/stable/c/4b9118e93d2499bb2808ef3742fa0ce06f4f8117'
  - url: 'https://git.kernel.org/stable/c/019ea28629720c220daedf38107c8787f330dc05'
  - url: 'https://git.kernel.org/stable/c/da39ee627fd82b52068d4d5f115749a8b7d271f9'
  - url: 'https://git.kernel.org/stable/c/427d048e4f6acbfa01b5a8062449fe0ee8987c0d'
  - url: 'https://git.kernel.org/stable/c/d2703b4f8fb7cc6f0dfdb2dc2359cc46189e7357'
  - url: 'https://git.kernel.org/stable/c/3bf9d023d2329a0e5379f2fd09d06ef09729cd9d'
  - url: 'https://git.kernel.org/stable/c/6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02583
ingestedAt: '2026-11-06T15:54:03.934Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path

When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls
kobject_put(&dbs_data->attr_set.kobj).

The kobject release callback cpufreq_dbs_data_release() calls
gov->exit(dbs_data) and kfree(dbs_data), but the current error path
then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a
double free.

Keep the direct kfree(dbs_data) for the gov->init() failure path, but
after kobject_init_and_add() has been called, let kobject_put() handle
the cleanup through cpufreq_dbs_data_release().

## Affected

- `Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee < 56bc91ee78babe9578585a2bc137abc4b3115ff3`
- `Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee < 4b9118e93d2499bb2808ef3742fa0ce06f4f8117`
- `Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee < 019ea28629720c220daedf38107c8787f330dc05`
- `Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee < da39ee627fd82b52068d4d5f115749a8b7d271f9`
- `Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee < 427d048e4f6acbfa01b5a8062449fe0ee8987c0d`
- `Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee < d2703b4f8fb7cc6f0dfdb2dc2359cc46189e7357`
- `Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee < 3bf9d023d2329a0e5379f2fd09d06ef09729cd9d`
- `Linux >= 4ebe36c94aed95de71a8ce6a6762226d31c938ee < 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e`
- `Linux e977b1477a6725868302957e6b5c330220391797`
- `Linux >= 5.1.6 < 5.2`
- `Linux 5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.