High 7.8Published May 6, 2026

CVE-2026-43196soc: ti: pruss: Fix double free in pruss_clk_mux_setup()

Updated under an hour ago (Oct 27, 2026, 1:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: soc: ti: pruss: Fix double free in pruss_clk_mux_setup() In the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly calls pruss_of_free_clk_provider(), which calls of_node_put(clk_mux_np) on the error path. However, after the devm_add_action_or_reset() returns, the of_node_put(clk_mux_np) is called again, causing a double free. Fix by returning directly, to avoid the duplicate of_node_put().

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ba59c9b43c86b2c2396acac94e41d946cbaec9fe before dbda01bf2dfe5af33163e1e5fca1b82b619c2803; from ba59c9b43c86b2c2396acac94e41d946cbaec9fe before 24c40076e3bc3d73c839c886d6bda1da6c4d9b93; from ba59c9b43c86b2c2396acac94e41d946cbaec9fe before 818cf66d91c8ef09b01664a12d5f4ea786d64396; from ba59c9b43c86b2c2396acac94e41d946cbaec9fe before e113339cc7d23be4948891f3a702e9dce5b47035; from ba59c9b43c86b2c2396acac94e41d946cbaec9fe before 69aa67c1e22d13e9aad4b08c86304ad8e743dcab; from ba59c9b43c86b2c2396acac94e41d946cbaec9fe before b7db9953c2f8da37de498198623b05b46f8e2ca0; from ba59c9b43c86b2c2396acac94e41d946cbaec9fe before 04dbbb18cc9c8795c9ff47d8994bc03ebfef9d68; from ba59c9b43c86b2c2396acac94e41d946cbaec9fe before 80db65d4acfb9ff12d00172aed39ea8b98261aad	CNA record
linux linux_kernel linux:linux_kernel	from 5.10 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/dbda01bf2dfe5af33163e1e5fca1b82b619c2803	patch
https://git.kernel.org/stable/c/24c40076e3bc3d73c839c886d6bda1da6c4d9b93	patch
https://git.kernel.org/stable/c/818cf66d91c8ef09b01664a12d5f4ea786d64396	patch
https://git.kernel.org/stable/c/e113339cc7d23be4948891f3a702e9dce5b47035	patch
https://git.kernel.org/stable/c/69aa67c1e22d13e9aad4b08c86304ad8e743dcab	patch
https://git.kernel.org/stable/c/b7db9953c2f8da37de498198623b05b46f8e2ca0	patch
https://git.kernel.org/stable/c/04dbbb18cc9c8795c9ff47d8994bc03ebfef9d68	patch
https://git.kernel.org/stable/c/80db65d4acfb9ff12d00172aed39ea8b98261aad	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.