Executive brief
The Linux kernel's CPU idle state power domain management code (cpuidle dt_idle_genpd) contains a memory management bug where the wrong memory address was being freed, causing heap corruption and memory leaks. This affects the core power management functionality on systems using this driver and could lead to kernel crashes or instability during runtime.
Technical details
The vulnerability is a use-after-free and incorrect memory freeing bug in drivers/cpuidle/dt_idle_genpd.c. The dt_idle_pd_alloc() function used kasprintf() to allocate memory for the full device node path, then reassigned the pd->name pointer to point at kbasename() (a substring within the allocated buffer). When dt_idle_pd_free() later calls kfree(pd->name), it attempts to free a pointer that is no longer at the start of the original allocation, corrupting the heap. The fix changes the code to use kstrdup(kbasename(...)) instead, creating a separate allocation for just the basename string. This is a local kernel memory management issue exploitable by code with access to trigger the power domain allocation/deallocation paths, though no network attack vector exists.
Affected products
- Linux Linux kernel Multiple kernel versions from 2.6.11.y through 7.2.y (approximately Linux 4.14 and later based on the cpuidle dt_idle_genpd code timeline)
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Fix committed upstream as commit 2b0ac85512b7f67479127b2713254490662eb13d