CVE-2026-64372

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free and Double Free in Linux Kernel cpufreq PCC

Publication date: 2026-07-25

Last updated on: 2026-09-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existing buffer to write into, the second call wrote into freed memory (use-after-free). The subsequent kfree(output.pointer) at out_free then freed the same pointer a second time (double free). Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, so ACPICA allocates a fresh buffer for each phase independently.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-08

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64372

EUVD

EUVD-2026-48916

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 2.6.34 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free and double free issue in the Linux kernel's cpufreq PCC (Platform Communication Channel) driver. It occurs during ACPI _OSC negotiation when acpi_evaluate_object() is called twice. The first call frees the output buffer but leaves its length set, causing the second call to write into freed memory (use-after-free). Later, the same pointer is freed again (double free).

Detection Guidance

This vulnerability is specific to the Linux kernel's cpufreq PCC driver and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the presence of vulnerable code in the kernel. Commands like dmesg | grep -i pcc or checking kernel version against patched releases may help.

Impact Analysis

This flaw could lead to kernel crashes, memory corruption, or privilege escalation if exploited. Systems using affected Linux kernel versions may become unstable or vulnerable to further attacks. Users should update their kernels to patched versions to mitigate risks.

Compliance Impact

This vulnerability is a memory corruption issue in the Linux kernel's cpufreq driver that could lead to system instability or crashes. It does not directly impact data privacy or security controls required by standards like GDPR or HIPAA. Compliance with these regulations depends on broader system security practices rather than this specific kernel flaw.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. Kernel updates can be applied via package managers like apt, yum, or dnf depending on the distribution. Reboot the system after applying the update to ensure the patched kernel is active.

Hi! I’m here to help you understand CVE-2026-64372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70