CVE-2026-43328cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
- 7.8HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release().
Timeline
ID reserved
By Linux
- 7 days later
· 7 days later
Published
- 6 months later
· 6 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 97% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 4ebe36c94aed95de71a8ce6a6762226d31c938ee – < 56bc91ee78babe9578585a2bc137abc4b3115ff3
- affected 4ebe36c94aed95de71a8ce6a6762226d31c938ee – < 4b9118e93d2499bb2808ef3742fa0ce06f4f8117
- affected 4ebe36c94aed95de71a8ce6a6762226d31c938ee – < 019ea28629720c220daedf38107c8787f330dc05
- affected 4ebe36c94aed95de71a8ce6a6762226d31c938ee – < da39ee627fd82b52068d4d5f115749a8b7d271f9
- affected 4ebe36c94aed95de71a8ce6a6762226d31c938ee – < 427d048e4f6acbfa01b5a8062449fe0ee8987c0d
- affected 4ebe36c94aed95de71a8ce6a6762226d31c938ee – < d2703b4f8fb7cc6f0dfdb2dc2359cc46189e7357
- affected 4ebe36c94aed95de71a8ce6a6762226d31c938ee – < 3bf9d023d2329a0e5379f2fd09d06ef09729cd9d
- affected 4ebe36c94aed95de71a8ce6a6762226d31c938ee – < 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e
- affected e977b1477a6725868302957e6b5c330220391797
- affected 5.1.6 – < 5.2
- affected 5.2
- unaffected < 5.2
- unaffected 5.10.253 – ≤ 5.10.*
- unaffected 5.15.209 – ≤ 5.15.*
- unaffected 6.1.168 – ≤ 6.1.*
- unaffected 6.6.134 – ≤ 6.6.*
- unaffected 6.12.81 – ≤ 6.12.*
- unaffected 6.18.22 – ≤ 6.18.*
- unaffected 6.19.12 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References8
- https://git.kernel.org/stable/c/56bc91ee78babe9578585a2bc137abc4b3115ff3 (opens in a new tab)
- https://git.kernel.org/stable/c/4b9118e93d2499bb2808ef3742fa0ce06f4f8117 (opens in a new tab)
- https://git.kernel.org/stable/c/019ea28629720c220daedf38107c8787f330dc05 (opens in a new tab)
- https://git.kernel.org/stable/c/da39ee627fd82b52068d4d5f115749a8b7d271f9 (opens in a new tab)
- https://git.kernel.org/stable/c/427d048e4f6acbfa01b5a8062449fe0ee8987c0d (opens in a new tab)
- https://git.kernel.org/stable/c/d2703b4f8fb7cc6f0dfdb2dc2359cc46189e7357 (opens in a new tab)
- https://git.kernel.org/stable/c/3bf9d023d2329a0e5379f2fd09d06ef09729cd9d (opens in a new tab)
- https://git.kernel.org/stable/c/6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-28612 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-43328)Record last updated .