CVE-2026-64118 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
qed: fix double free in qed_cxt_tables_alloc()
If one of the later PF or VF CID bitmap allocations fails, qed_cid_map_alloc() jumps to cid_map_fail and frees the previously allocated CID bitmaps before returning an error. qed_cxt_tables_alloc() then calls qed_cxt_mngr_free(), which invokes qed_cid_map_free() again.
Fix this by setting each CID bitmap pointer to NULL after bitmap_free() to avoid double free.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3.
Runtime reproduction was not attempted because exercising the failing allocation path requires device-specific setup.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel represents a critical memory management flaw within the qed driver's context table allocation mechanism. This double free condition occurs specifically within the qed_cxt_tables_alloc() function where proper resource cleanup procedures are not adequately enforced during error handling scenarios. The issue manifests when subsequent PF or VF CID bitmap allocations fail, triggering a cascade of memory deallocation operations that ultimately results in attempting to free the same memory region twice. The root cause lies in the lack of proper pointer nullification after successful deallocation, creating a scenario where the same memory block can be freed multiple times during error path execution.
The technical implementation flaw stems from insufficient state management within the qed_cxt_tables_alloc() function's error handling routine. When qed_cid_map_alloc() encounters allocation failure, it properly executes cleanup operations by invoking cid_map_fail and subsequently freeing previously allocated CID bitmaps through qed_cid_map_free(). However, the calling function qed_cxt_tables_alloc() continues execution and ultimately calls qed_cxt_mngr_free(), which redundantly invokes qed_cid_map_free() on the same memory regions that were already freed. This violates fundamental memory safety principles and creates potential for undefined behavior including system crashes, data corruption, or exploitation opportunities.
From an operational perspective, this vulnerability presents significant risks to system stability and security integrity within environments utilizing qed network drivers. The double free condition can lead to heap corruption that may be exploited by malicious actors to achieve privilege escalation or denial of service attacks. According to CWE classification, this represents a CWE-415: Double Free vulnerability, which falls under the broader category of memory safety issues. The ATT&CK framework categorizes this as a memory corruption technique that could enable adversaries to manipulate system behavior through controlled heap manipulation. The vulnerability affects systems running kernel versions including v7.1-rc3 and earlier releases where the fix has not yet been applied.
The mitigation strategy requires implementing proper pointer nullification after each successful memory deallocation operation within the error handling path. Specifically, each CID bitmap pointer must be explicitly set to NULL immediately following qed_cid_map_free() execution to prevent subsequent redundant free operations. This approach aligns with established secure coding practices and prevents the double free scenario by ensuring that freed memory regions cannot be accessed again through the same pointer references. The fix addresses the fundamental flaw in resource management where state tracking was insufficient during error conditions, thereby restoring proper memory lifecycle management within the qed driver's context allocation subsystem.
This vulnerability demonstrates the critical importance of robust error handling in kernel space memory management operations. The issue was initially detected through advanced static analysis techniques rather than runtime testing, highlighting the necessity of automated verification tools for identifying subtle memory safety issues in complex kernel codebases. The fact that manual inspection confirmed the bug's presence in v7.1-rc3 underscores how easily such flaws can persist across multiple kernel versions without proper automated detection mechanisms. The fix implementation represents a straightforward but essential defensive programming practice that prevents potential exploitation while maintaining system stability and preventing cascading failures that could affect network connectivity or overall system operation.