Executive brief
The Linux kernel's i.MX 6Q CPU frequency scaling driver contains a memory safety bug that triggers when the driver is unbound and then bound again. A static counter variable is not reset between probe cycles, causing the driver to write past the end of a newly allocated array and corrupt kernel memory. This could lead to kernel crashes or potential privilege escalation if exploitable.
Technical details
A static variable `soc_opp_count` in the imx6q-cpufreq.c driver is used to index into a dynamically allocated array `imx6_soc_volt` during probe. The array is allocated fresh on each probe (sized to the number of ARM OPPs), but the static counter is never reset. On a second bind after unbind, the counter continues from where it left off, writing past the end of the newly allocated array. The vulnerability is triggered via kernel module unbind/rebind, and manifests as a KASAN slab-out-of-bounds write of one u32 element past the allocation boundary. The fix converts `soc_opp_count` from static storage to a local variable initialized to 0, since it is only needed within the probe function scope. Patches have been merged into stable Linux kernel trees.
Affected products
- Linux Linux kernel multiple versions (exact range not specified in advisory)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Patch committed to stable kernel trees; upstream commit 8c3afcf27fa4582c1ab912503dc8a4ebb8dc0f82