Executive brief
The Linux kernel's CPU frequency scaling driver for i.MX6 processors has a memory leak during driver rebind operations. Every time the driver is reloaded, memory allocated for voltage scaling arrays is not properly freed, causing accumulation of unused memory that persists for the system's lifetime. This degrades system reliability over extended uptime or repeated driver reload cycles.
Technical details
The vulnerability is a resource management bug in the imx6q-cpufreq driver. The imx6_soc_volt array was allocated using devm_kcalloc() tied to the CPU device (from get_cpu_device(0)), which is never unbound during normal operation. This caused its devres list to persist indefinitely, allowing stale allocations to accumulate on every driver probe without cleanup. The fix changes the allocation context to the platform device instead, ensuring proper cleanup when the driver is unbound. Additionally, file-scope pointers are cleared in both the remove path and failed-probe path to prevent use-after-free scenarios. The attack vector is local to the system and requires the ability to rebind the driver, with no special privileges beyond module loading capability.
Affected products
- Linux Linux kernel multiple versions (patch applied across linux-2.6.11.y through linux-7.2.y stable branches)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-08-06: patched: Upstream fix committed by Karl Mehltretter
- 2026-09-14: patched: Patch included in stable Linux kernel releases