CVE-2026-64251

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64251", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.773Z", "datePublished": "2026-07-24T15:31:17.601Z", "dateUpdated": "2026-08-17T04:52:02.919Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:52:02.919Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()\n\npwrseq_debugfs_seq_next() declares 'next' with __free(put_device),\nwhich causes put_device() to be called on the returned pointer when\nthe variable goes out of scope. This results in a use-after-free\nsince the seq_file framework receives a pointer whose reference has\nalready been dropped.\n\nSimply removing __free(put_device) would fix the UAF but would leak\nthe reference acquired by bus_find_next_device(), as stop() only\ncalls up_read(&pwrseq_sem) and never releases the device reference.\n\nFix this by making the reference counting consistent across all\nseq_file callbacks, matching the standard pattern used by PCI and\nSCSI:\n\n- start(): use get_device() so it returns a referenced pointer.\n- next(): explicitly put_device(curr) to release the previous\n device's reference (no NULL check needed - the seq_file framework\n only calls next() while the previous return was non-NULL).\n- stop(): put_device(data) to release the last iterated device's\n reference, with a NULL guard since stop() may be called with NULL\n when start() returned NULL or next() reached end-of-sequence."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached by locally opening and reading the pwrseq debugfs file, which flows through seq_read_iter() into pwrseq_debugfs_seq_next(). No network, radio, or remotely reachable protocol invokes this path.\nAC:L - On an affected system with at least two registered power-sequencer devices, a sufficiently large read deterministically invokes next() followed by show() on the prematurely unreferenced device. No race or victim-controlled timing is required.\nPR:L - The pwrseq node is created as 0444 with no capability check, so an ordinary local user can trigger it when debugfs is exposed through its supported mode or ownership options. Although debugfs defaults to a root-only 0700 root and cannot be mounted from an unprivileged user namespace, unprivileged-readable diagnostic deployments are reasonable.\nUI:N - The attacker triggers the vulnerability directly by reading the debugfs file; no action by another user is necessary.\nS:U - Exploitation affects the kernel and resources governed by the same operating-system security authority. The path does not cross a VM, IOMMU, or comparable isolation boundary.\nC:H - The premature device-reference release creates a use-after-free involving a heap-allocated pwrseq_device whose device, name, target, unit, and list pointers are subsequently dereferenced. Heap reclamation can therefore provide a powerful kernel-memory disclosure primitive.\nI:H - Reclaiming the freed object with attacker-influenced data can make subsequent device, klist, list, and reference-count operations act on forged pointers. This is defensibly exploitable for arbitrary kernel-memory corruption and control-flow hijacking.\nA:H - The stale pointer can cause invalid device or list traversal, refcount corruption, an oops, or a kernel panic. The attacker can repeatedly invoke the vulnerable read path."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/sequencing/core.c"], "versions": [{"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c", "lessThan": "ba0b9f04c7a5f9887b8ce672eaf049502c0548ec", "status": "affected", "versionType": "git"}, {"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c", "lessThan": "e91df6d273445c03f5aa302bfe147eda33d45794", "status": "affected", "versionType": "git"}, {"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c", "lessThan": "73569a44fca2992f0ca4a4c0104069741b9873a0", "status": "affected", "versionType": "git"}, {"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c", "lessThan": "257595adf9dac15ae1edd9d07753fbc576a7583d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/sequencing/core.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.38"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec"}, {"url": "https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794"}, {"url": "https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0"}, {"url": "https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d"}], "title": "pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/power/sequencing/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ba0b9f04c7a5f9887b8ce672eaf049502c0548ec", "status": "affected", "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c", "versionType": "git"}, {"lessThan": "e91df6d273445c03f5aa302bfe147eda33d45794", "status": "affected", "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c", "versionType": "git"}, {"lessThan": "73569a44fca2992f0ca4a4c0104069741b9873a0", "status": "affected", "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c", "versionType": "git"}, {"lessThan": "257595adf9dac15ae1edd9d07753fbc576a7583d", "status": "affected", "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/power/sequencing/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.95", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.38", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "366244A3-18F7-431B-A01F-B0A69754C096", "versionEndExcluding": "6.12.95", "versionStartIncluding": "6.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A", "versionEndExcluding": "6.18.38", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E", "versionEndExcluding": "7.1.3", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()\n\npwrseq_debugfs_seq_next() declares 'next' with __free(put_device),\nwhich causes put_device() to be called on the returned pointer when\nthe variable goes out of scope. This results in a use-after-free\nsince the seq_file framework receives a pointer whose reference has\nalready been dropped.\n\nSimply removing __free(put_device) would fix the UAF but would leak\nthe reference acquired by bus_find_next_device(), as stop() only\ncalls up_read(&pwrseq_sem) and never releases the device reference.\n\nFix this by making the reference counting consistent across all\nseq_file callbacks, matching the standard pattern used by PCI and\nSCSI:\n\n- start(): use get_device() so it returns a referenced pointer.\n- next(): explicitly put_device(curr) to release the previous\n device's reference (no NULL check needed - the seq_file framework\n only calls next() while the previous return was non-NULL).\n- stop(): put_device(data) to release the last iterated device's\n reference, with a NULL guard since stop() may be called with NULL\n when start() returned NULL or next() reached end-of-sequence."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npwrseq: core: correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en pwrseq_debugfs_seq_next()\n\npwrseq_debugfs_seq_next() declara \u2019next\u2019 con __free(put_device), lo que provoca que se llame a put_device() en el puntero devuelto cuando la variable sale de \u00e1mbito. Esto resulta en un uso despu\u00e9s de liberaci\u00f3n ya que el framework seq_file recibe un puntero cuya referencia ya ha sido liberada.\n\nSimplemente eliminar __free(put_device) corregir\u00eda el UAF pero fugar\u00eda la referencia adquirida por bus_find_next_device(), ya que stop() solo llama a up_read(&pwrseq_sem) y nunca libera la referencia del dispositivo.\n\nCorregir esto haciendo que el conteo de referencias sea consistente en todas las retrollamadas de seq_file, coincidiendo con el patr\u00f3n est\u00e1ndar utilizado por PCI y SCSI:\n\n- start(): usar get_device() para que devuelva un puntero referenciado.\n- next(): llamar expl\u00edcitamente a put_device(curr) para liberar la referencia del dispositivo anterior (no se necesita comprobaci\u00f3n de NULL - el framework seq_file solo llama a next() mientras el retorno anterior no era NULL).\n- stop(): llamar a put_device(data) para liberar la referencia del \u00faltimo dispositivo iterado, con una protecci\u00f3n contra NULL ya que stop() puede ser llamado con NULL cuando start() devolvi\u00f3 NULL o next() alcanz\u00f3 el fin de secuencia."}], "id": "CVE-2026-64251", "lastModified": "2026-11-08T20:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-24T16:16:54.713", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", "id": "2506810", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506810"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["No description is available for this CVE."], "name": "CVE-2026-64251", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64251\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64251\nhttps://lore.kernel.org/linux-cve-announce/2026072419-CVE-2026-64251-7ab2@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[249ebf3f65f8530beb2cbfb91bff1d83ba88d23c,ba0b9f04c7a5f9887b8ce672eaf049502c0548ec)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[249ebf3f65f8530beb2cbfb91bff1d83ba88d23c,e91df6d273445c03f5aa302bfe147eda33d45794)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[249ebf3f65f8530beb2cbfb91bff1d83ba88d23c,73569a44fca2992f0ca4a4c0104069741b9873a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[249ebf3f65f8530beb2cbfb91bff1d83ba88d23c,257595adf9dac15ae1edd9d07753fbc576a7583d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.38,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.3,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-24T23:15:04.652660+00:00", "updated": "2026-08-13T11:00:12.636500+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}