{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.96-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  mfd: cros_ec: Delay dev_set_drvdata() until probe success  If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access \u0026typec-\u003eec-\u003eec-\u003edev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded.   sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'  Call trace:   sysfs_do_create_link_sd+0x94/0xdc   sysfs_create_link+0x30/0x44   device_add_class_symlinks+0x90/0x13c   device_add+0xf0/0x50c   ec_device_probe+0x150/0x4f0   platform_probe+0xa0/0xe0  ...  BUG: KASAN: invalid-access in __memcpy+0x44/0x230  Write at addr f5ffff809e2d33ac by task kworker/u32:5/125  Pointer tag: [f5], memory tag: [fe]  Tainted : [W]=WARN, [O]=OOT_MODULE  Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3  Workqueue: events_unbound deferred_probe_work_func  Call trace:   __memcpy+0x44/0x230   cros_ec_check_features+0x60/0xcc [cros_ec_proto]   cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]   platform_probe+0xa0/0xe0",
  "id": "DEBIAN-CVE-2026-64420",
  "modified": "2026-09-14T16:47:42.264814583Z",
  "published": "2026-07-25T10:17:25.963Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64420"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64420"
  ]
}