CVE-2026-64251 (GCVE-0-2026-64251)

Vulnerability from cvelistv5 – Published: 2026-07-24 15:31 – Updated: 2026-08-05 12:40
VLAI
Title
pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
Summary
In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() declares 'next' with __free(put_device), which causes put_device() to be called on the returned pointer when the variable goes out of scope. This results in a use-after-free since the seq_file framework receives a pointer whose reference has already been dropped. Simply removing __free(put_device) would fix the UAF but would leak the reference acquired by bus_find_next_device(), as stop() only calls up_read(&pwrseq_sem) and never releases the device reference. Fix this by making the reference counting consistent across all seq_file callbacks, matching the standard pattern used by PCI and SCSI: - start(): use get_device() so it returns a referenced pointer. - next(): explicitly put_device(curr) to release the previous device's reference (no NULL check needed - the seq_file framework only calls next() while the previous return was non-NULL). - stop(): put_device(data) to release the last iterated device's reference, with a NULL guard since stop() may be called with NULL when start() returned NULL or next() reached end-of-sequence.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c , < ba0b9f04c7a5f9887b8ce672eaf049502c0548ec (git)
Affected: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c , < e91df6d273445c03f5aa302bfe147eda33d45794 (git)
Affected: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c , < 73569a44fca2992f0ca4a4c0104069741b9873a0 (git)
Affected: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c , < 257595adf9dac15ae1edd9d07753fbc576a7583d (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba0b9f04c7a5f9887b8ce672eaf049502c0548ec",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "e91df6d273445c03f5aa302bfe147eda33d45794",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "73569a44fca2992f0ca4a4c0104069741b9873a0",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "257595adf9dac15ae1edd9d07753fbc576a7583d",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()\n\npwrseq_debugfs_seq_next() declares \u0027next\u0027 with __free(put_device),\nwhich causes put_device() to be called on the returned pointer when\nthe variable goes out of scope.  This results in a use-after-free\nsince the seq_file framework receives a pointer whose reference has\nalready been dropped.\n\nSimply removing __free(put_device) would fix the UAF but would leak\nthe reference acquired by bus_find_next_device(), as stop() only\ncalls up_read(\u0026pwrseq_sem) and never releases the device reference.\n\nFix this by making the reference counting consistent across all\nseq_file callbacks, matching the standard pattern used by PCI and\nSCSI:\n\n- start(): use get_device() so it returns a referenced pointer.\n- next(): explicitly put_device(curr) to release the previous\n  device\u0027s reference (no NULL check needed - the seq_file framework\n  only calls next() while the previous return was non-NULL).\n- stop(): put_device(data) to release the last iterated device\u0027s\n  reference, with a NULL guard since stop() may be called with NULL\n  when start() returned NULL or next() reached end-of-sequence."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached by locally opening and reading the pwrseq debugfs file, which flows through seq_read_iter() into pwrseq_debugfs_seq_next(). No network, radio, or remotely reachable protocol invokes this path.\nAC:L - On an affected system with at least two registered power-sequencer devices, a sufficiently large read deterministically invokes next() followed by show() on the prematurely unreferenced device. No race or victim-controlled timing is required.\nPR:L - The pwrseq node is created as 0444 with no capability check, so an ordinary local user can trigger it when debugfs is exposed through its supported mode or ownership options. Although debugfs defaults to a root-only 0700 root and cannot be mounted from an unprivileged user namespace, unprivileged-readable diagnostic deployments are reasonable.\nUI:N - The attacker triggers the vulnerability directly by reading the debugfs file; no action by another user is necessary.\nS:U - Exploitation affects the kernel and resources governed by the same operating-system security authority. The path does not cross a VM, IOMMU, or comparable isolation boundary.\nC:H - The premature device-reference release creates a use-after-free involving a heap-allocated pwrseq_device whose device, name, target, unit, and list pointers are subsequently dereferenced. Heap reclamation can therefore provide a powerful kernel-memory disclosure primitive.\nI:H - Reclaiming the freed object with attacker-influenced data can make subsequent device, klist, list, and reference-count operations act on forged pointers. This is defensibly exploitable for arbitrary kernel-memory corruption and control-flow hijacking.\nA:H - The stale pointer can cause invalid device or list traversal, refcount corruption, an oops, or a kernel panic. The attacker can repeatedly invoke the vulnerable read path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:40:17.105Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794"
        },
        {
          "url": "https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d"
        }
      ],
      "title": "pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64251",
    "datePublished": "2026-07-24T15:31:17.601Z",
    "dateReserved": "2026-07-19T15:36:31.773Z",
    "dateUpdated": "2026-08-05T12:40:17.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64251",
      "date": "2026-08-05",
      "epss": "0.00117",
      "percentile": "0.01922"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64251\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-24T16:16:54.713\",\"lastModified\":\"2026-07-30T15:00:27.343\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()\\n\\npwrseq_debugfs_seq_next() declares \u0027next\u0027 with __free(put_device),\\nwhich causes put_device() to be called on the returned pointer when\\nthe variable goes out of scope.  This results in a use-after-free\\nsince the seq_file framework receives a pointer whose reference has\\nalready been dropped.\\n\\nSimply removing __free(put_device) would fix the UAF but would leak\\nthe reference acquired by bus_find_next_device(), as stop() only\\ncalls up_read(\u0026pwrseq_sem) and never releases the device reference.\\n\\nFix this by making the reference counting consistent across all\\nseq_file callbacks, matching the standard pattern used by PCI and\\nSCSI:\\n\\n- start(): use get_device() so it returns a referenced pointer.\\n- next(): explicitly put_device(curr) to release the previous\\n  device\u0027s reference (no NULL check needed - the seq_file framework\\n  only calls next() while the previous return was non-NULL).\\n- stop(): put_device(data) to release the last iterated device\u0027s\\n  reference, with a NULL guard since stop() may be called with NULL\\n  when start() returned NULL or next() reached end-of-sequence.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/power/sequencing/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"249ebf3f65f8530beb2cbfb91bff1d83ba88d23c\",\"lessThan\":\"ba0b9f04c7a5f9887b8ce672eaf049502c0548ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"249ebf3f65f8530beb2cbfb91bff1d83ba88d23c\",\"lessThan\":\"e91df6d273445c03f5aa302bfe147eda33d45794\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"249ebf3f65f8530beb2cbfb91bff1d83ba88d23c\",\"lessThan\":\"73569a44fca2992f0ca4a4c0104069741b9873a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"249ebf3f65f8530beb2cbfb91bff1d83ba88d23c\",\"lessThan\":\"257595adf9dac15ae1edd9d07753fbc576a7583d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/power/sequencing/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T12:17:23+00:00",
      "cve": "CVE-2026-64251",
      "id": "CVE-2026-64251",
      "initial_release_date": "2026-07-24T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64251.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-25T00:13:37Z",
      "cve": "CVE-2026-64251",
      "id": "CVE-2026-64251",
      "initial_release_date": "2026-07-25T00:13:37Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64251",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64251.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.