CVE-2026-64222
octeontx2-pf: avoid double free of pool->stack on AQ init failure
Description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific cn20k_pool_aq_init() implementation has the same bug in its corresponding error path. Set pool->stack to NULL immediately after the local free so the shared cleanup path does not free the same stack again while cleaning up partially initialized pool state. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime validation was not performed because reproducing this path requires OcteonTX2/CN20K hardware.
INFO
Published Date :
July 24, 2026, 4:16 p.m.
Last Modified :
July 24, 2026, 4:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Set pool->stack to NULL after freeing pool->stack.
- Apply the vendor-provided patch.
- Update the Linux kernel to a fixed version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64222.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64222 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64222
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64222 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64222 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'caa2da34fd25a37e9fd43343b6966fb9d730a6d5', 'lessThan': 'e6e9bc0bf963662b7042048ab0281014625d4cb4', 'versionType': 'git'}, {'status': 'affected', 'version': 'caa2da34fd25a37e9fd43343b6966fb9d730a6d5', 'lessThan': 'b92e7ea408b6f1144648909c9c49a55d245d7300', 'versionType': 'git'}, {'status': 'affected', 'version': 'caa2da34fd25a37e9fd43343b6966fb9d730a6d5', 'lessThan': '94192b0579333c3deee2441379aab8ca98fc2e6b', 'versionType': 'git'}, {'status': 'affected', 'version': 'caa2da34fd25a37e9fd43343b6966fb9d730a6d5', 'lessThan': '4c29603498b05c049dbbbc47e882f2fbf0193cd7', 'versionType': 'git'}, {'status': 'affected', 'version': 'caa2da34fd25a37e9fd43343b6966fb9d730a6d5', 'lessThan': '0488a0bb344fb1992853b60082acff6be8164d74', 'versionType': 'git'}, {'status': 'affected', 'version': 'caa2da34fd25a37e9fd43343b6966fb9d730a6d5', 'lessThan': '0d9b9d7dbef976ae7f855b6358f1d703014e96ea', 'versionType': 'git'}, {'status': 'affected', 'version': 'caa2da34fd25a37e9fd43343b6966fb9d730a6d5', 'lessThan': 'c4b8c5d51632538b19ee01cf6d70cbceeefbd3ec', 'versionType': 'git'}, {'status': 'affected', 'version': 'caa2da34fd25a37e9fd43343b6966fb9d730a6d5', 'lessThan': '9b244c242bec48b37e82b89787afd6a4c43457e1', 'versionType': 'git'}], 'programFiles': ['drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c', 'drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.6'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.6', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c', 'drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific cn20k_pool_aq_init() implementation has the same bug in its corresponding error path. Set pool->stack to NULL immediately after the local free so the shared cleanup path does not free the same stack again while cleaning up partially initialized pool state. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime validation was not performed because reproducing this path requires OcteonTX2/CN20K hardware. Added Reference https://git.kernel.org/stable/c/0488a0bb344fb1992853b60082acff6be8164d74 Added Reference https://git.kernel.org/stable/c/0d9b9d7dbef976ae7f855b6358f1d703014e96ea Added Reference https://git.kernel.org/stable/c/4c29603498b05c049dbbbc47e882f2fbf0193cd7 Added Reference https://git.kernel.org/stable/c/94192b0579333c3deee2441379aab8ca98fc2e6b Added Reference https://git.kernel.org/stable/c/9b244c242bec48b37e82b89787afd6a4c43457e1 Added Reference https://git.kernel.org/stable/c/b92e7ea408b6f1144648909c9c49a55d245d7300 Added Reference https://git.kernel.org/stable/c/c4b8c5d51632538b19ee01cf6d70cbceeefbd3ec Added Reference https://git.kernel.org/stable/c/e6e9bc0bf963662b7042048ab0281014625d4cb4