news.mlab.sh
Vulnerabilities
Vulnerability

CVE-2026-43328

Reference data from vuln.mlab.sh, coverage from our own index.

CVSS
7.0 High
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.13%
Risk score
2.0
Published
2026-05-08
Status
Published

In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release(). A flaw was found in the Linux kernel's cpufreq governor. An error in the cpufreq_dbs_governor_init() function's cleanup path, specifically when kobject_init_and_add() fails, causes a double free of memory. This memory corruption vulnerability can be exploited by a local attacker, potentially leading to system instability or a denial of service (DoS).

Weaknesses

CWE-763

Coverage 6

Advisories and references