CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: governor: fix double free in cpufreqdbsgovernorinit() error path
When kobjectinitandadd() fails, cpufreqdbsgovernorinit() calls kobjectput(&dbsdata->attrset.kobj).
The kobject release callback cpufreqdbsdatarelease() calls gov->exit(dbsdata) and kfree(dbsdata), but the current error path then calls gov->exit(dbsdata) and kfree(dbsdata) again, causing a double free.
Keep the direct kfree(dbsdata) for the gov->init() failure path, but after kobjectinitandadd() has been called, let kobjectput() handle the cleanup through cpufreqdbsdatarelease().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2026-43328?
CVE-2026-43328 is a vulnerability in the Linux kernel that involves a double free issue in the cpufreq_dbs_governor_init() error path.
What software is affected by CVE-2026-43328?
The vulnerability CVE-2026-43328 affects the Linux kernel.
What is the severity of CVE-2026-43328?
The severity of CVE-2026-43328 has been assessed based on its impact and exploitability.
How do I fix CVE-2026-43328?
To fix CVE-2026-43328, users should update their Linux kernel to the latest patched version that addresses this vulnerability.
Is CVE-2026-43328 exploitable remotely?
CVE-2026-43328 does not appear to have a direct remote exploit vector.