CVE-2026-64222 Linux CVE debrief

Who should care

Users of the Linux kernel, especially those using OcteonTX2/CN20K hardware, should be aware of this vulnerability and take steps to mitigate it. This includes operators managing Linux kernel deployments, platform administrators responsible for system updates, vulnerability management teams assessing exposure, and security teams tracking potential impacts. They should assess their exposure, plan for vendor-supported updates or mitigations, review compensating controls, and monitor for potential attacks.

Technical summary

The vulnerability is caused by a double free of pool->stack on AQ init failure in the Linux kernel. The bug is in the otx2_pool_aq_init() function, which frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific cn20k_pool_aq_init() implementation has the same bug in its corresponding error path. To fix this bug, set pool->stack to NULL immediately after the local free so the shared cleanup path does not free the same stack again while cleaning up partially initialized pool state.

Defensive priority

High

Recommended defensive actions

• Inventory and assess Linux kernel usage, especially on OcteonTX2/CN20K hardware
• Apply vendor patches or updates when available
• Monitor for potential denial of service or code execution attacks
• Implement compensating controls, such as memory protection and access controls
• Perform regular vulnerability scans and penetration testing

Evidence notes

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime validation was not performed because reproducing this path requires OcteonTX2/CN20K hardware.

Official resources