CVE-2026-64118 Linux CVE debrief

Who should care

System administrators and users of Linux kernel versions affected by this vulnerability should be aware of the issue and ensure they apply the necessary patches to prevent exploitation.

Technical summary

The vulnerability is caused by a double free in the qed_cxt_tables_alloc() function of the Linux kernel. When a later PF or VF CID bitmap allocation fails, the function jumps to cid_map_fail, freeing previously allocated CID bitmaps. However, qed_cxt_tables_alloc() then calls qed_cxt_mngr_free(), which again invokes qed_cid_map_free(), resulting in a double free. The fix sets CID bitmap pointers to NULL after bitmap_free() to avoid double frees.

Defensive priority

Medium

Recommended defensive actions

• Apply the official patch to fix the double free vulnerability in qed_cxt_tables_alloc().
• Ensure all Linux kernel versions affected by this vulnerability are patched.
• Monitor system logs for any signs of exploitation attempts.
• Perform a thorough review of system configurations to ensure they align with security best practices.
• Verify that all necessary security updates are applied to prevent exploitation.
• Track and document changes to system configurations and updates.
• Implement additional monitoring to detect potential exploitation attempts.

Evidence notes

The vulnerability was first flagged by an experimental analysis tool for kernel memory-management bugs while analyzing v6.13-rc1. Manual inspection confirms the bug is still present in v7.1-rc3. Runtime reproduction was not attempted due to the device-specific setup required.

Official resources