{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba0b9f04c7a5f9887b8ce672eaf049502c0548ec",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "e91df6d273445c03f5aa302bfe147eda33d45794",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "73569a44fca2992f0ca4a4c0104069741b9873a0",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            },
            {
              "lessThan": "257595adf9dac15ae1edd9d07753fbc576a7583d",
              "status": "affected",
              "version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/sequencing/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()\n\npwrseq_debugfs_seq_next() declares \u0027next\u0027 with __free(put_device),\nwhich causes put_device() to be called on the returned pointer when\nthe variable goes out of scope.  This results in a use-after-free\nsince the seq_file framework receives a pointer whose reference has\nalready been dropped.\n\nSimply removing __free(put_device) would fix the UAF but would leak\nthe reference acquired by bus_find_next_device(), as stop() only\ncalls up_read(\u0026pwrseq_sem) and never releases the device reference.\n\nFix this by making the reference counting consistent across all\nseq_file callbacks, matching the standard pattern used by PCI and\nSCSI:\n\n- start(): use get_device() so it returns a referenced pointer.\n- next(): explicitly put_device(curr) to release the previous\n  device\u0027s reference (no NULL check needed - the seq_file framework\n  only calls next() while the previous return was non-NULL).\n- stop(): put_device(data) to release the last iterated device\u0027s\n  reference, with a NULL guard since stop() may be called with NULL\n  when start() returned NULL or next() reached end-of-sequence."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached by locally opening and reading the pwrseq debugfs file, which flows through seq_read_iter() into pwrseq_debugfs_seq_next(). No network, radio, or remotely reachable protocol invokes this path.\nAC:L - On an affected system with at least two registered power-sequencer devices, a sufficiently large read deterministically invokes next() followed by show() on the prematurely unreferenced device. No race or victim-controlled timing is required.\nPR:L - The pwrseq node is created as 0444 with no capability check, so an ordinary local user can trigger it when debugfs is exposed through its supported mode or ownership options. Although debugfs defaults to a root-only 0700 root and cannot be mounted from an unprivileged user namespace, unprivileged-readable diagnostic deployments are reasonable.\nUI:N - The attacker triggers the vulnerability directly by reading the debugfs file; no action by another user is necessary.\nS:U - Exploitation affects the kernel and resources governed by the same operating-system security authority. The path does not cross a VM, IOMMU, or comparable isolation boundary.\nC:H - The premature device-reference release creates a use-after-free involving a heap-allocated pwrseq_device whose device, name, target, unit, and list pointers are subsequently dereferenced. Heap reclamation can therefore provide a powerful kernel-memory disclosure primitive.\nI:H - Reclaiming the freed object with attacker-influenced data can make subsequent device, klist, list, and reference-count operations act on forged pointers. This is defensibly exploitable for arbitrary kernel-memory corruption and control-flow hijacking.\nA:H - The stale pointer can cause invalid device or list traversal, refcount corruption, an oops, or a kernel panic. The attacker can repeatedly invoke the vulnerable read path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:02.919Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794"
        },
        {
          "url": "https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d"
        }
      ],
      "title": "pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64251",
    "datePublished": "2026-07-24T15:31:17.601Z",
    "dateReserved": "2026-07-19T15:36:31.773Z",
    "dateUpdated": "2026-08-17T04:52:02.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}