CVE-2026-90295: cpufreq: imx6q: fix out-of-bounds write when probed more than once
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: imx6q: fix out-of-bounds write when probed more than once
imx6socvolt is allocated fresh on every probe, sized to the number of ARM OPPs:
imx6socvolt = devmkcalloc(cpudev, num, sizeof(imx6socvolt), GFPKERNEL);
but it is filled through socoppcount, which has static storage and is never reset. A second bind after an unbind keeps indexing from where the first one stopped, and writes past the end of the new array.
Unbinding and rebinding the driver on qemu's mcimx6ul-evk, under KASAN:
BUG: KASAN: slab-out-of-bounds in imx6qcpufreqprobe+0x3b0/0xa34 Write of size 4 at addr c5e90480 by task binder/73 imx6qcpufreqprobe from platformprobe+0x88/0xe4 platformprobe from reallyprobe+0x108/0x384 bindstore from kernfsfopwriteiter+0x1b4/0x28c
The write lands one u32 past the end of the allocation.
socoppcount is only read a few lines below the loop that fills it, so it never needed static storage. Make it a local.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel imx6q CPU frequency driver are exposed when that driver can be unbound and then bound again. The reported reproduction used QEMU's mcimx6ul-evk platform.
What must happen for the out-of-bounds write to occur?
The imx6q cpufreq driver must be probed more than once. After an unbind and rebind, a static counter retains its value from the first probe while a newly allocated voltage array starts at its original size, causing writes past that array.
What can be done before applying a fix?
Avoid unbinding and rebinding the imx6q cpufreq driver. The issue is tied specifically to a second probe after the driver has previously been probed.
How can this issue be identified during testing?
Kernel AddressSanitizer can report a slab-out-of-bounds write in imx6q_cpufreq_probe after unbinding and rebinding the driver. The reported write is a 4-byte write immediately beyond the newly allocated array.