Vulnerability-Lookup

FKIE_CVE-2026-64251

Vulnerability from fkie_nvd - Published: 2026-07-24 16:16 - Updated: 2026-07-30 15:00

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() declares 'next' with __free(put_device), which causes put_device() to be called on the returned pointer when the variable goes out of scope. This results in a use-after-free since the seq_file framework receives a pointer whose reference has already been dropped. Simply removing __free(put_device) would fix the UAF but would leak the reference acquired by bus_find_next_device(), as stop() only calls up_read(&pwrseq_sem) and never releases the device reference. Fix this by making the reference counting consistent across all seq_file callbacks, matching the standard pattern used by PCI and SCSI: - start(): use get_device() so it returns a referenced pointer. - next(): explicitly put_device(curr) to release the previous device's reference (no NULL check needed - the seq_file framework only calls next() while the previous return was non-NULL). - stop(): put_device(data) to release the last iterated device's reference, with a NULL guard since stop() may be called with NULL when start() returned NULL or next() reached end-of-sequence.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba0b9f04c7a5f9887b8ce672eaf049502c0548ec",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "e91df6d273445c03f5aa302bfe147eda33d45794",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "73569a44fca2992f0ca4a4c0104069741b9873a0",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "257595adf9dac15ae1edd9d07753fbc576a7583d",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()\n\npwrseq_debugfs_seq_next() declares \u0027next\u0027 with __free(put_device),\nwhich causes put_device() to be called on the returned pointer when\nthe variable goes out of scope.  This results in a use-after-free\nsince the seq_file framework receives a pointer whose reference has\nalready been dropped.\n\nSimply removing __free(put_device) would fix the UAF but would leak\nthe reference acquired by bus_find_next_device(), as stop() only\ncalls up_read(\u0026pwrseq_sem) and never releases the device reference.\n\nFix this by making the reference counting consistent across all\nseq_file callbacks, matching the standard pattern used by PCI and\nSCSI:\n\n- start(): use get_device() so it returns a referenced pointer.\n- next(): explicitly put_device(curr) to release the previous\n  device\u0027s reference (no NULL check needed - the seq_file framework\n  only calls next() while the previous return was non-NULL).\n- stop(): put_device(data) to release the last iterated device\u0027s\n  reference, with a NULL guard since stop() may be called with NULL\n  when start() returned NULL or next() reached end-of-sequence."
    }
  ],
  "id": "CVE-2026-64251",
  "lastModified": "2026-07-30T15:00:27.343",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-24T16:16:54.713",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}

CVE-2026-64251 (GCVE-0-2026-64251)

Vulnerability from cvelistv5 – Published: 2026-07-24 15:31 – Updated: 2026-08-05 12:40

Title

pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/ba0b9f04c7a5f9887…
https://git.kernel.org/stable/c/e91df6d273445c03f…
https://git.kernel.org/stable/c/73569a44fca2992f0…
https://git.kernel.org/stable/c/257595adf9dac15ae…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c , < ba0b9f04c7a5f9887b8ce672eaf049502c0548ec (git) Affected: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c , < e91df6d273445c03f5aa302bfe147eda33d45794 (git) Affected: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c , < 73569a44fca2992f0ca4a4c0104069741b9873a0 (git) Affected: 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c , < 257595adf9dac15ae1edd9d07753fbc576a7583d (git)
Linux	Linux	Affected: 6.11 Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba0b9f04c7a5f9887b8ce672eaf049502c0548ec",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "e91df6d273445c03f5aa302bfe147eda33d45794",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "73569a44fca2992f0ca4a4c0104069741b9873a0",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "257595adf9dac15ae1edd9d07753fbc576a7583d",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()\n\npwrseq_debugfs_seq_next() declares \u0027next\u0027 with __free(put_device),\nwhich causes put_device() to be called on the returned pointer when\nthe variable goes out of scope.  This results in a use-after-free\nsince the seq_file framework receives a pointer whose reference has\nalready been dropped.\n\nSimply removing __free(put_device) would fix the UAF but would leak\nthe reference acquired by bus_find_next_device(), as stop() only\ncalls up_read(\u0026pwrseq_sem) and never releases the device reference.\n\nFix this by making the reference counting consistent across all\nseq_file callbacks, matching the standard pattern used by PCI and\nSCSI:\n\n- start(): use get_device() so it returns a referenced pointer.\n- next(): explicitly put_device(curr) to release the previous\n  device\u0027s reference (no NULL check needed - the seq_file framework\n  only calls next() while the previous return was non-NULL).\n- stop(): put_device(data) to release the last iterated device\u0027s\n  reference, with a NULL guard since stop() may be called with NULL\n  when start() returned NULL or next() reached end-of-sequence."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached by locally opening and reading the pwrseq debugfs file, which flows through seq_read_iter() into pwrseq_debugfs_seq_next(). No network, radio, or remotely reachable protocol invokes this path.\nAC:L - On an affected system with at least two registered power-sequencer devices, a sufficiently large read deterministically invokes next() followed by show() on the prematurely unreferenced device. No race or victim-controlled timing is required.\nPR:L - The pwrseq node is created as 0444 with no capability check, so an ordinary local user can trigger it when debugfs is exposed through its supported mode or ownership options. Although debugfs defaults to a root-only 0700 root and cannot be mounted from an unprivileged user namespace, unprivileged-readable diagnostic deployments are reasonable.\nUI:N - The attacker triggers the vulnerability directly by reading the debugfs file; no action by another user is necessary.\nS:U - Exploitation affects the kernel and resources governed by the same operating-system security authority. The path does not cross a VM, IOMMU, or comparable isolation boundary.\nC:H - The premature device-reference release creates a use-after-free involving a heap-allocated pwrseq_device whose device, name, target, unit, and list pointers are subsequently dereferenced. Heap reclamation can therefore provide a powerful kernel-memory disclosure primitive.\nI:H - Reclaiming the freed object with attacker-influenced data can make subsequent device, klist, list, and reference-count operations act on forged pointers. This is defensibly exploitable for arbitrary kernel-memory corruption and control-flow hijacking.\nA:H - The stale pointer can cause invalid device or list traversal, refcount corruption, an oops, or a kernel panic. The attacker can repeatedly invoke the vulnerable read path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:40:17.105Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794"
        },
        {
          "url": "https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d"
        }
      ],
      "title": "pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64251",
    "datePublished": "2026-07-24T15:31:17.601Z",
    "dateReserved": "2026-07-19T15:36:31.773Z",
    "dateUpdated": "2026-08-05T12:40:17.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

FKIE_CVE-2026-64251

CVE-2026-64251 (GCVE-0-2026-64251)

Tags

Sightings

Nomenclature