CVE-2026-64251: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64251 Overview

CVE-2026-64251 is a use-after-free vulnerability in the Linux kernel's power sequencing (pwrseq) core subsystem. The flaw resides in the pwrseq_debugfs_seq_next() function, which declared the next pointer using the __free(put_device) cleanup attribute. This caused put_device() to be invoked on the returned pointer once the variable went out of scope, leaving the seq_file framework holding a reference to freed memory.

A local attacker with access to the affected debugfs interface can trigger the dangling reference during sequential iteration. Exploitation of use-after-free conditions in kernel context can lead to memory corruption, privilege escalation, or system compromise [CWE-416].

Critical Impact
Local exploitation of this kernel use-after-free can yield high impact to confidentiality, integrity, and availability, including potential privilege escalation to root.

Affected Products

Linux kernel versions containing the pwrseq core subsystem with the flawed __free(put_device) cleanup pattern in pwrseq_debugfs_seq_next()
Distributions shipping vulnerable stable kernel branches prior to the referenced upstream fix commits
Systems exposing the pwrseq debugfs interface to local users

Discovery Timeline

2026-07-24 - CVE-2026-64251 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64251

Vulnerability Analysis

The vulnerability affects the seq_file iteration callbacks used by the pwrseq core to expose device information via debugfs. In pwrseq_debugfs_seq_next(), the local variable next was annotated with the __free(put_device) cleanup attribute. When the function returned, the compiler-generated cleanup handler called put_device() on the pointer being returned to the seq_file framework, dropping its reference count before the caller consumed it.

The seq_file framework then dereferenced a device pointer whose backing reference had already been released. Under memory pressure or concurrent device removal, the underlying struct device could be freed and reallocated, resulting in classic use-after-free behavior in kernel address space.

Root Cause

The root cause is inconsistent reference counting across the three seq_file callbacks (start(), next(), stop()). The start() callback used bus_find_next_device() which returns a referenced pointer, but the next() callback prematurely released that reference via the automatic cleanup attribute. Meanwhile, stop() only called up_read(&pwrseq_sem) and never balanced the outstanding device reference, meaning naive removal of __free(put_device) would instead cause a reference leak.

Attack Vector

Exploitation requires local access with permissions to read the affected debugfs entry. An attacker races iteration of the pwrseq seq_file against device teardown to convert the dangling reference into a controlled use-after-free. Successful exploitation targets kernel memory allocator state to achieve arbitrary read or write primitives and escalate to root.

No verified public proof-of-concept code has been published. The upstream fix aligns reference counting with the pattern used by the PCI and SCSI subsystems: start() uses get_device() to return a referenced pointer, next() explicitly calls put_device(curr) on the previous device, and stop() releases the final reference with a NULL guard.

Detection Methods for CVE-2026-64251

Indicators of Compromise

Kernel oops or panic messages referencing pwrseq_debugfs_seq_next, seq_read, or put_device in call traces
KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads inside the pwrseq core during debugfs access
Unexpected reads of /sys/kernel/debug/pwrseq/ entries by unprivileged or non-administrative user sessions

Detection Strategies

Audit installed kernel package versions against distribution advisories referencing the upstream fix commits 257595adf9da, 73569a44fca2, ba0b9f04c7a5, and e91df6d27344
Enable KASAN in test or staging kernels to surface use-after-free access patterns during pwrseq debugfs iteration
Monitor dmesg and journald for kernel warnings, refcount underflow messages, or slab corruption near struct device allocations

Monitoring Recommendations

Log and alert on process access to debugfs paths under pwrseq, particularly from non-root or service accounts
Track kernel crash telemetry across Linux fleets to identify anomalous panics correlated with power sequencing code paths
Correlate device hot-remove events with concurrent debugfs reads to detect potential race exploitation attempts

How to Mitigate CVE-2026-64251

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 257595adf9da, 73569a44fca2, ba0b9f04c7a5, and e91df6d27344 as delivered by your distribution vendor
Restrict debugfs mount access to root only by ensuring /sys/kernel/debug is mounted with restrictive permissions (mode 0700, owner root)
Inventory Linux hosts running kernels that include the vulnerable pwrseq core and prioritize patching multi-tenant and shared systems

Patch Information

The fix restructures reference counting across the seq_file callbacks in the pwrseq core. Refer to the upstream kernel commits: 257595adf9da, 73569a44fca2, ba0b9f04c7a5, and e91df6d27344. Rebuild or install vendor kernels that incorporate these commits and reboot affected systems.

Workarounds

Unmount or disable debugfs on production systems where kernel debugging interfaces are not required: umount /sys/kernel/debug
Remove the pwrseq module if it is not needed for the platform, or block loading via /etc/modprobe.d/
Ensure only administrative users can access /sys/kernel/debug/pwrseq/ until patched kernels are deployed

bash

# Configuration example
# Restrict debugfs access to root only
mount -o remount,mode=700 /sys/kernel/debug

# Optional: prevent debugfs from mounting at boot
# Edit /etc/fstab and comment out or remove the debugfs entry

# Verify kernel version after patching
uname -r