CVE-2026-64251 (GCVE-0-2026-64251)
Vulnerability from cvelistv5
Published
2026-07-24 15:31
Modified
2026-08-17 04:52
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() declares 'next' with __free(put_device), which causes put_device() to be called on the returned pointer when the variable goes out of scope. This results in a use-after-free since the seq_file framework receives a pointer whose reference has already been dropped. Simply removing __free(put_device) would fix the UAF but would leak the reference acquired by bus_find_next_device(), as stop() only calls up_read(&pwrseq_sem) and never releases the device reference. Fix this by making the reference counting consistent across all seq_file callbacks, matching the standard pattern used by PCI and SCSI: - start(): use get_device() so it returns a referenced pointer. - next(): explicitly put_device(curr) to release the previous device's reference (no NULL check needed - the seq_file framework only calls next() while the previous return was non-NULL). - stop(): put_device(data) to release the last iterated device's reference, with a NULL guard since stop() may be called with NULL when start() returned NULL or next() reached end-of-sequence.
References
Impacted products
Vendor Product Version
Linux Linux Version: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c
Version: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c
Version: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c
Version: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba0b9f04c7a5f9887b8ce672eaf049502c0548ec",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "e91df6d273445c03f5aa302bfe147eda33d45794",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "73569a44fca2992f0ca4a4c0104069741b9873a0",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "257595adf9dac15ae1edd9d07753fbc576a7583d",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()\n\npwrseq_debugfs_seq_next() declares \u0027next\u0027 with __free(put_device),\nwhich causes put_device() to be called on the returned pointer when\nthe variable goes out of scope.  This results in a use-after-free\nsince the seq_file framework receives a pointer whose reference has\nalready been dropped.\n\nSimply removing __free(put_device) would fix the UAF but would leak\nthe reference acquired by bus_find_next_device(), as stop() only\ncalls up_read(\u0026pwrseq_sem) and never releases the device reference.\n\nFix this by making the reference counting consistent across all\nseq_file callbacks, matching the standard pattern used by PCI and\nSCSI:\n\n- start(): use get_device() so it returns a referenced pointer.\n- next(): explicitly put_device(curr) to release the previous\n  device\u0027s reference (no NULL check needed - the seq_file framework\n  only calls next() while the previous return was non-NULL).\n- stop(): put_device(data) to release the last iterated device\u0027s\n  reference, with a NULL guard since stop() may be called with NULL\n  when start() returned NULL or next() reached end-of-sequence."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached by locally opening and reading the pwrseq debugfs file, which flows through seq_read_iter() into pwrseq_debugfs_seq_next(). No network, radio, or remotely reachable protocol invokes this path.\nAC:L - On an affected system with at least two registered power-sequencer devices, a sufficiently large read deterministically invokes next() followed by show() on the prematurely unreferenced device. No race or victim-controlled timing is required.\nPR:L - The pwrseq node is created as 0444 with no capability check, so an ordinary local user can trigger it when debugfs is exposed through its supported mode or ownership options. Although debugfs defaults to a root-only 0700 root and cannot be mounted from an unprivileged user namespace, unprivileged-readable diagnostic deployments are reasonable.\nUI:N - The attacker triggers the vulnerability directly by reading the debugfs file; no action by another user is necessary.\nS:U - Exploitation affects the kernel and resources governed by the same operating-system security authority. The path does not cross a VM, IOMMU, or comparable isolation boundary.\nC:H - The premature device-reference release creates a use-after-free involving a heap-allocated pwrseq_device whose device, name, target, unit, and list pointers are subsequently dereferenced. Heap reclamation can therefore provide a powerful kernel-memory disclosure primitive.\nI:H - Reclaiming the freed object with attacker-influenced data can make subsequent device, klist, list, and reference-count operations act on forged pointers. This is defensibly exploitable for arbitrary kernel-memory corruption and control-flow hijacking.\nA:H - The stale pointer can cause invalid device or list traversal, refcount corruption, an oops, or a kernel panic. The attacker can repeatedly invoke the vulnerable read path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:02.919Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794"
        },
        {
          "url": "https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d"
        }
      ],
      "title": "pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64251",
    "datePublished": "2026-07-24T15:31:17.601Z",
    "dateReserved": "2026-07-19T15:36:31.773Z",
    "dateUpdated": "2026-08-17T04:52:02.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.