CVE-2026-90295

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: imx6q: fix out-of-bounds write when probed more than once

imx6_soc_volt is allocated fresh on every probe, sized to the number of

ARM OPPs:

imx6_soc_volt = devm_kcalloc(cpu_dev, num, sizeof(*imx6_soc_volt),

GFP_KERNEL);

but it is filled through soc_opp_count, which has static storage and is

never reset. A second bind after an unbind keeps indexing from where the

first one stopped, and writes past the end of the new array.

Unbinding and rebinding the driver on qemu's mcimx6ul-evk, under KASAN:

BUG: KASAN: slab-out-of-bounds in imx6q_cpufreq_probe+0x3b0/0xa34

Write of size 4 at addr c5e90480 by task binder/73

imx6q_cpufreq_probe from platform_probe+0x88/0xe4

platform_probe from really_probe+0x108/0x384

bind_store from kernfs_fop_write_iter+0x1b4/0x28c

The write lands one u32 past the end of the allocation.

soc_opp_count is only read a few lines below the loop that fills it, so it

n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References