CVE-2026-64246 Overview
CVE-2026-64246 is a use-after-free vulnerability in the Linux kernel's linkstation-poweroff power reset driver. The flaw resides in the linkstation_poweroff_init() function, where of_node_put(dn) was invoked before of_match_node(), even though the latter still requires the device tree node pointer. Referencing a released node produces classic use-after-free behavior. The patch reorders the calls so that of_node_put(dn) runs only after of_match_node() completes, correctly releasing the node reference after use. The issue affects Linux kernel builds that compile the linkstation-poweroff driver, typically used on Buffalo LinkStation network-attached storage hardware.
Critical Impact
A use-after-free in kernel initialization code can lead to memory corruption, kernel crashes, or potential local privilege escalation on affected systems.
Affected Products
- Linux kernel with the power: reset: linkstation-poweroff driver enabled
- Distributions shipping vulnerable stable kernel branches referenced in the kernel.org fix commits
- Buffalo LinkStation devices running vulnerable Linux kernel builds
Discovery Timeline
- 2026-07-24 - CVE-2026-64246 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64246
Vulnerability Analysis
The vulnerability is a use-after-free [CWE-416] in the Linux kernel driver responsible for handling power-off requests on Buffalo LinkStation devices. During driver initialization, the code obtains a device tree node reference via a lookup function and then calls of_node_put(dn), which decrements the reference count and potentially frees the underlying node. The subsequent call to of_match_node() continues to dereference the same node pointer, reading from memory that may already have been released or reused. This creates a window in which the kernel operates on invalid memory during boot or module load.
Root Cause
The root cause is an ordering error in reference-count lifetime management for device tree nodes. of_node_put() must only be called once the caller no longer needs the node. The original code released the reference too early, before of_match_node() finished consuming the pointer. The corrected patch moves of_node_put(dn) to execute after of_match_node() returns, ensuring the node remains valid throughout its use.
Attack Vector
Exploitation requires the vulnerable driver to be loaded on a system, which is limited to kernels configured with CONFIG_POWER_RESET_LINKSTATION and matching device tree entries. The bug triggers during driver initialization rather than through remote input, making it primarily a local reliability and memory-safety concern. No public proof-of-concept or in-the-wild exploitation has been reported. Fix details are available in the kernel.org stable commits, including commit 2205275 and commit d109e72.
Detection Methods for CVE-2026-64246
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing linkstation_poweroff_init in dmesg or /var/log/kern.log
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free in of_match_node call paths during boot
- Repeated driver load failures or reboots on affected LinkStation-class devices
Detection Strategies
- Inventory running kernels against fixed stable versions listed in the kernel.org commit references
- Enable KASAN on test builds to surface the use-after-free deterministically during driver initialization
- Correlate kernel crash telemetry with the linkstation-poweroff module across the fleet
Monitoring Recommendations
- Ingest kernel logs into a centralized log platform and alert on kernel oops, BUG, or KASAN entries
- Track kernel package versions across Linux hosts and flag systems still running unpatched builds
- Monitor reboot patterns on Buffalo LinkStation and similar embedded Linux devices for stability regressions
How to Mitigate CVE-2026-64246
Immediate Actions Required
- Upgrade to a Linux kernel version that includes the fix commits published on kernel.org for the linkstation-poweroff driver
- Apply vendor-supplied kernel updates from your Linux distribution as soon as they become available
- Prioritize patching Buffalo LinkStation devices and other embedded systems using this driver
Patch Information
The fix reorders of_node_put(dn) to occur after of_match_node() in linkstation_poweroff_init(). Fixes have been merged across multiple stable branches. Reference commits include commit 3928ae8, commit 8eec545, commit 93c7ee1, commit c04d606, and commit cdda7d3.
Workarounds
- Disable the linkstation-poweroff driver by unsetting CONFIG_POWER_RESET_LINKSTATION in custom kernel builds where the functionality is not required
- Restrict physical and administrative access to devices running the vulnerable driver until patches are applied
- Rebuild affected embedded Linux images from a patched stable kernel tree before redeployment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
