CVE-2026-64251

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel pwrseq Core

Publication date: 2026-07-24

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() declares 'next' with __free(put_device), which causes put_device() to be called on the returned pointer when the variable goes out of scope. This results in a use-after-free since the seq_file framework receives a pointer whose reference has already been dropped. Simply removing __free(put_device) would fix the UAF but would leak the reference acquired by bus_find_next_device(), as stop() only calls up_read(&pwrseq_sem) and never releases the device reference. Fix this by making the reference counting consistent across all seq_file callbacks, matching the standard pattern used by PCI and SCSI: - start(): use get_device() so it returns a referenced pointer. - next(): explicitly put_device(curr) to release the previous device's reference (no NULL check needed - the seq_file framework only calls next() while the previous return was non-NULL). - stop(): put_device(data) to release the last iterated device's reference, with a NULL guard since stop() may be called with NULL when start() returned NULL or next() reached end-of-sequence.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64251

EUVD

EUVD-2026-48660

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.11 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.38 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's pwrseq subsystem. The issue occurs in the pwrseq_debugfs_seq_next() function where a device reference is freed prematurely due to the __free(put_device) annotation. This causes the seq_file framework to receive a pointer whose reference has already been dropped, leading to a use-after-free condition when the variable goes out of scope.

Detection Guidance

This vulnerability is specific to the Linux kernel's pwrseq subsystem and requires kernel-level inspection. Detection involves checking kernel logs for use-after-free errors or analyzing the pwrseq_debugfs_seq_next() function behavior. No standard network commands apply. Inspect kernel logs with 'dmesg | grep -i use-after-free' or check the kernel source for pwrseq_debugfs_seq_next() implementation.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code in the kernel. It may lead to system crashes, data corruption, or privilege escalation if exploited. Systems running vulnerable versions of the Linux kernel are at risk.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's pwrseq subsystem, which could lead to memory corruption or crashes. It does not directly relate to data privacy or security controls required by GDPR or HIPAA, as it is a low-level system bug rather than a data exposure or access control flaw.

Mitigation Strategies

Apply the Linux kernel patch that fixes the use-after-free in pwrseq_debugfs_seq_next(). Update to a kernel version containing the fix. If immediate patching is not possible, disable the pwrseq subsystem if not required, or restrict access to debugfs entries related to pwrseq.

Hi! I’m here to help you understand CVE-2026-64251. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70