CVE-2026-64420

A flaw was found in the Linux kernel's cros_ec driver. This vulnerability, a use-after-free, occurs when the device's data pointer is set too early during initialization. If the initialization process fails, the memory for the cros_ec_dev structure is released, but other kernel components, such as the cros_ec_typec driver, may still attempt to access the freed memory using a stale pointer. This can lead to an invalid memory access, resulting in a system crash and a denial of service.