CVE-2026-64420 (GCVE-0-2026-64420)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
Title
mfd: cros_ec: Delay dev_set_drvdata() until probe success
Summary
In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded. sysfs: cannot create duplicate filename '/class/chromeos/cros_ec' Call trace: sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x44 device_add_class_symlinks+0x90/0x13c device_add+0xf0/0x50c ec_device_probe+0x150/0x4f0 platform_probe+0xa0/0xe0 ... BUG: KASAN: invalid-access in __memcpy+0x44/0x230 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125 Pointer tag: [f5], memory tag: [fe] Tainted : [W]=WARN, [O]=OOT_MODULE Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3 Workqueue: events_unbound deferred_probe_work_func Call trace: __memcpy+0x44/0x230 cros_ec_check_features+0x60/0xcc [cros_ec_proto] cros_typec_probe+0xe8/0x6e0 [cros_ec_typec] platform_probe+0xa0/0xe0
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b , < 24522713034d521ea4b5f5f36342e2b2f7e73bd6 (git)
Affected: 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b , < f7e81dc181d9fe8ab977158042cd193e8cc12091 (git)
Affected: 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b , < 257203d83204b192d1265a916b42ca0d499bb117 (git)
Affected: 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b , < 729ae27dc2503a7c1f92da1859efb45da03e4fa0 (git)
Affected: 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b , < ed2941e5db016a0c600b25f1972620e6e223d9fa (git)
Affected: 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b , < b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d (git)
Affected: 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b , < fc030c5b116f668d4ca86dca63742ddbc98d1665 (git)
Affected: 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b , < 8b2c1d41bc36c100b38ce5ee6def246c527eaf8a (git)
Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mfd/cros_ec_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24522713034d521ea4b5f5f36342e2b2f7e73bd6",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "f7e81dc181d9fe8ab977158042cd193e8cc12091",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "257203d83204b192d1265a916b42ca0d499bb117",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "729ae27dc2503a7c1f92da1859efb45da03e4fa0",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "ed2941e5db016a0c600b25f1972620e6e223d9fa",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "fc030c5b116f668d4ca86dca63742ddbc98d1665",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "8b2c1d41bc36c100b38ce5ee6def246c527eaf8a",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mfd/cros_ec_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: cros_ec: Delay dev_set_drvdata() until probe success\n\nIf ec_device_probe() fails, cros_ec_class_release releases memory for the\ncros_ec_dev structure. However, because the drvdata was already set,\nsub-drivers like cros_ec_typec can still retrieve the stale pointer via the\nplatform device. This leads to a use-after-free when cros_ec_typec attempts\nto access \u0026typec-\u003eec-\u003eec-\u003edev on a device that has already been released.\nMove dev_set_drvdata() to ensure that the pointer is only made available\nonce all initialization steps have succeeded.\n\n sysfs: cannot create duplicate filename \u0027/class/chromeos/cros_ec\u0027\n Call trace:\n  sysfs_do_create_link_sd+0x94/0xdc\n  sysfs_create_link+0x30/0x44\n  device_add_class_symlinks+0x90/0x13c\n  device_add+0xf0/0x50c\n  ec_device_probe+0x150/0x4f0\n  platform_probe+0xa0/0xe0\n ...\n BUG: KASAN: invalid-access in __memcpy+0x44/0x230\n Write at addr f5ffff809e2d33ac by task kworker/u32:5/125\n Pointer tag: [f5], memory tag: [fe]\n Tainted : [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n  __memcpy+0x44/0x230\n  cros_ec_check_features+0x60/0xcc [cros_ec_proto]\n  cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]\n  platform_probe+0xa0/0xe0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF occurs in local platform-device probe work for an internally connected ChromeOS EC and its Type-C child, with no network or USB-peer entry point. Exploitation would require local heap shaping or probe-timing influence.\nAC:H - Exploitation requires EC probe failure, such as a duplicate class name, while the Type-C probe concurrently captures the pointer before driver-core cleanup, followed by useful slab reuse. An unprivileged attacker cannot directly control both sides of this race.\nPR:L - On a device whose firmware topology already produces the failure, no capability check protects the automatic probe path, and an unprivileged local process can attempt heap grooming and timing manipulation. User namespaces cannot directly create or rebind these platform devices, but real-root privileges are not required for that exploitation role.\nUI:N - The kernel automatically enumerates and probes both devices through platform-bus workqueues. No victim action such as opening a file, mounting something, or attaching a peripheral is required.\nS:U - The vulnerable driver and the affected kernel memory share the same operating-system security authority. This is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - The freed object contains kernel pointers and may be replaced by another kmalloc object before stale accesses occur. Exploitable UAF reuse can provide kernel-memory disclosure, so confidentiality impact is High.\nI:H - cros_ec_check_features() can copy an eight-byte EC feature response into the freed object, corrupting any replacement object occupying that slab slot. Heap shaping could turn this write-after-free into control-flow corruption or kernel code execution.\nA:H - The observed write-after-free occurs in a kernel workqueue and can produce an oops or panic. It can also disrupt device initialization or repeatedly prevent a vulnerable system from completing a reliable boot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:51.271Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091"
        },
        {
          "url": "https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117"
        },
        {
          "url": "https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a"
        }
      ],
      "title": "mfd: cros_ec: Delay dev_set_drvdata() until probe success",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64420",
    "datePublished": "2026-07-25T08:50:59.115Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-05T12:41:51.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64420",
      "date": "2026-08-09",
      "epss": "0.00118",
      "percentile": "0.01996"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64420\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:25.963\",\"lastModified\":\"2026-07-27T05:16:48.827\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmfd: cros_ec: Delay dev_set_drvdata() until probe success\\n\\nIf ec_device_probe() fails, cros_ec_class_release releases memory for the\\ncros_ec_dev structure. However, because the drvdata was already set,\\nsub-drivers like cros_ec_typec can still retrieve the stale pointer via the\\nplatform device. This leads to a use-after-free when cros_ec_typec attempts\\nto access \u0026typec-\u003eec-\u003eec-\u003edev on a device that has already been released.\\nMove dev_set_drvdata() to ensure that the pointer is only made available\\nonce all initialization steps have succeeded.\\n\\n sysfs: cannot create duplicate filename \u0027/class/chromeos/cros_ec\u0027\\n Call trace:\\n  sysfs_do_create_link_sd+0x94/0xdc\\n  sysfs_create_link+0x30/0x44\\n  device_add_class_symlinks+0x90/0x13c\\n  device_add+0xf0/0x50c\\n  ec_device_probe+0x150/0x4f0\\n  platform_probe+0xa0/0xe0\\n ...\\n BUG: KASAN: invalid-access in __memcpy+0x44/0x230\\n Write at addr f5ffff809e2d33ac by task kworker/u32:5/125\\n Pointer tag: [f5], memory tag: [fe]\\n Tainted : [W]=WARN, [O]=OOT_MODULE\\n Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3\\n Workqueue: events_unbound deferred_probe_work_func\\n Call trace:\\n  __memcpy+0x44/0x230\\n  cros_ec_check_features+0x60/0xcc [cros_ec_proto]\\n  cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]\\n  platform_probe+0xa0/0xe0\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/mfd/cros_ec_dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\"lessThan\":\"24522713034d521ea4b5f5f36342e2b2f7e73bd6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\"lessThan\":\"f7e81dc181d9fe8ab977158042cd193e8cc12091\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\"lessThan\":\"257203d83204b192d1265a916b42ca0d499bb117\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\"lessThan\":\"729ae27dc2503a7c1f92da1859efb45da03e4fa0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\"lessThan\":\"ed2941e5db016a0c600b25f1972620e6e223d9fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\"lessThan\":\"b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\"lessThan\":\"fc030c5b116f668d4ca86dca63742ddbc98d1665\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b\",\"lessThan\":\"8b2c1d41bc36c100b38ce5ee6def246c527eaf8a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/mfd/cros_ec_dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-29T14:52:59+00:00",
      "cve": "CVE-2026-64420",
      "id": "CVE-2026-64420",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mfd: cros_ec: Delay dev_set_drvdata() until probe success",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64420.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.