Description
In the Linux kernel, the following vulnerability has been resolved:

pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()

pwrseq_debugfs_seq_next() declares 'next' with __free(put_device),
which causes put_device() to be called on the returned pointer when
the variable goes out of scope. This results in a use-after-free
since the seq_file framework receives a pointer whose reference has
already been dropped.

Simply removing __free(put_device) would fix the UAF but would leak
the reference acquired by bus_find_next_device(), as stop() only
calls up_read(&pwrseq_sem) and never releases the device reference.

Fix this by making the reference counting consistent across all
seq_file callbacks, matching the standard pattern used by PCI and
SCSI:

- start(): use get_device() so it returns a referenced pointer.
- next(): explicitly put_device(curr) to release the previous
device's reference (no NULL check needed - the seq_file framework
only calls next() while the previous return was non-NULL).
- stop(): put_device(data) to release the last iterated device's
reference, with a NULL guard since stop() may be called with NULL
when start() returned NULL or next() reached end-of-sequence.
Published: 2026-07-24
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free in the pwrseq core module’s debugfs sequence routine. The function pwrseq_debugfs_seq_next() returns a device pointer that is incorrectly annotated with __free(put_device), causing the kernel to release the reference while the seq_file framework still holds and later dereferences the pointer. This results in accessing freed kernel memory, which can corrupt the kernel’s data structures or crash the system. The weakness is classified as CWE-416 and CWE‑911.

Affected Systems

Affected systems are Linux kernels that have not incorporated the commit that fixes the reference‑counting issue. Since the CNA list includes only Linux:Linux without a version range, any kernel version older than the patch commit should be considered vulnerable. The affected component is the pwrseq subsystem in the kernel's power management & debugfs interface.

Risk and Exploitability

The CVSS base score of 7.8 signifies high severity for kernel‑space flaws. The EPSS score is less than 1 %, indicating a low yet nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker needs local access and the ability to read the debugfs interface to trigger the UAF. Therefore, while exploitation may be difficult, systems should still address the flaw promptly.

Generated by OpenCVE AI on August 13, 2026 at 10:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the kernel to a version that includes the pwrseq debugfs sequence reference‑counting fix
  • Disable or restrict access to the debugfs filesystem (e.g., mount it root‑only, unmount it, or protect it with a secure filesystem mount)
  • If the pwrseq subsystem is not required, blacklist or unload the module to prevent the flaw from being exercised

Generated by OpenCVE AI on August 13, 2026 at 10:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sun, 02 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Thu, 30 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 29 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-911
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 27 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() declares 'next' with __free(put_device), which causes put_device() to be called on the returned pointer when the variable goes out of scope. This results in a use-after-free since the seq_file framework receives a pointer whose reference has already been dropped. Simply removing __free(put_device) would fix the UAF but would leak the reference acquired by bus_find_next_device(), as stop() only calls up_read(&pwrseq_sem) and never releases the device reference. Fix this by making the reference counting consistent across all seq_file callbacks, matching the standard pattern used by PCI and SCSI: - start(): use get_device() so it returns a referenced pointer. - next(): explicitly put_device(curr) to release the previous device's reference (no NULL check needed - the seq_file framework only calls next() while the previous return was non-NULL). - stop(): put_device(data) to release the last iterated device's reference, with a NULL guard since stop() may be called with NULL when start() returned NULL or next() reached end-of-sequence.
Title pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-05T12:40:17.105Z

Reserved: 2026-07-19T15:36:31.773Z

Link: CVE-2026-64251

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-24T16:16:54.713

Modified: 2026-08-12T15:53:38.763

Link: CVE-2026-64251

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-24T00:00:00Z

Links: CVE-2026-64251 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T11:00:12Z

Weaknesses