Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

CVE-2026-43196: Linux kernel: Double free in pruss_clk_mux_setup() fixed

CVE-2026-43196
Summary

A fix has been made to prevent a double free error in the Linux kernel's pruss_clk_mux_setup() function. This affects systems using the Linux kernel, particularly those with Texas Instruments (TI) PRUSS components. Users of these systems should ensure they have the latest kernel updates to benefit from this fix.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versions
linux linux_kernel >= 5.10, < 5.10.252
>= 5.11, < 5.15.202
>= 5.16, < 6.1.165
>= 6.2, < 6.6.128
>= 6.7, < 6.12.75
>= 6.13, < 6.18.16
>= 6.19, < 6.19.6
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Original title
In the Linux kernel, the following vulnerability has been resolved: soc: ti: pruss: Fix double free in pruss_clk_mux_setup() In the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectl...
Original description
In the Linux kernel, the following vulnerability has been resolved:

soc: ti: pruss: Fix double free in pruss_clk_mux_setup()

In the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly
calls pruss_of_free_clk_provider(), which calls of_node_put(clk_mux_np)
on the error path. However, after the devm_add_action_or_reset()
returns, the of_node_put(clk_mux_np) is called again, causing a double
free.

Fix by returning directly, to avoid the duplicate of_node_put().
nvd CVSS3.1 7.8
Vulnerability type
CWE-415
Published: 6 May 2026 · Updated: 22 Jul 2026 · First seen: 11 May 2026