CVE-2026-64372 Overview
CVE-2026-64372 is a memory corruption vulnerability in the Linux kernel's Processor Clocking Control (PCC) cpufreq driver. The flaw resides in pcc_cpufreq_do_osc(), which performs a two-phase Advanced Configuration and Power Interface (ACPI) _OSC negotiation by calling acpi_evaluate_object() twice. Between the two calls, the driver freed output.pointer but did not reset output.length, causing the second ACPICA call to write into freed memory. The subsequent cleanup then freed the same pointer again, producing both a use-after-free [CWE-416] and a double free [CWE-415] condition.
Critical Impact
A local attacker with low privileges on an affected system can trigger kernel memory corruption, potentially leading to privilege escalation, kernel panic, or arbitrary code execution in kernel context.
Affected Products
- Linux kernel builds containing the pcc-cpufreq driver prior to the fix commits
- Distributions shipping stable kernel branches referenced in the upstream patch series
- Systems using ACPI Processor Clocking Control for frequency scaling
Discovery Timeline
- 2026-07-25 - CVE-2026-64372 published to the National Vulnerability Database
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64372
Vulnerability Analysis
The defect exists in the Processor Clocking Control cpufreq driver's ACPI Operating System Capabilities (_OSC) negotiation routine. The two-phase handshake requires two sequential invocations of acpi_evaluate_object(), each of which returns an ACPI buffer through the output structure containing a pointer and length field.
After the first call, the driver freed output.pointer but did not clear output.length. ACPICA interprets a non-zero length combined with a non-NULL pointer as a caller-provided buffer to write into. Because the freed pointer value was not reset, the second call treated the stale address as a valid destination buffer and wrote ACPI response data into deallocated memory.
Execution then reached the out_free label, where kfree(output.pointer) released the same address a second time. The result is both a use-after-free during the ACPI write and a double free during cleanup.
Root Cause
The root cause is incomplete state cleanup between the two acpi_evaluate_object() invocations. The fix resets output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result. This instructs ACPICA to allocate a fresh buffer independently for each negotiation phase.
Attack Vector
Exploitation requires local access with low privileges on a system that loads the pcc-cpufreq driver. An attacker with the ability to trigger the affected code path during driver initialization or reconfiguration can influence kernel heap state. Successful exploitation of the use-after-free write and subsequent double free can corrupt kernel slab allocator metadata, enabling privilege escalation to root or full system compromise.
No public proof-of-concept exploit is available for CVE-2026-64372 at the time of publication. See the upstream fix commit for the corrected buffer-handling sequence.
Detection Methods for CVE-2026-64372
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing pcc_cpufreq_do_osc or acpi_evaluate_object in dmesg output
- KASAN reports flagging use-after-free or double-free conditions in the pcc-cpufreq module
- Slab allocator corruption warnings during system boot or cpufreq driver load
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) in test and staging environments to surface the corruption path during driver initialization
- Compare running kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts
- Audit which systems load the pcc-cpufreq module using lsmod inventory collection across the fleet
Monitoring Recommendations
- Forward kernel logs (/var/log/kern.log, journalctl -k) to a centralized logging pipeline for anomaly review
- Alert on repeated kernel warnings, oops events, or unexpected reboots on ACPI-enabled server hardware
- Track privilege escalation indicators and unexpected root-level process creation on systems running vulnerable kernels
How to Mitigate CVE-2026-64372
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected systems
- Inventory all Linux hosts running the pcc-cpufreq driver and prioritize patching for multi-tenant or shared-user systems
- Restrict local shell access to trusted administrative users until patches are deployed
Patch Information
The fix is available across multiple stable kernel branches. Reference commits include 0e3c739, 266d3dd, 5cdb25f, 632666a, 6ba6f67, 8e454e9, 982c9f9, and a36ca93. Consult your Linux distribution vendor for backported package releases.
Workarounds
- Blacklist the pcc-cpufreq module on systems that do not require Processor Clocking Control by adding blacklist pcc-cpufreq to /etc/modprobe.d/ configuration
- Switch to an alternative cpufreq driver such as acpi-cpufreq where hardware support permits
- Limit local account access and enforce least-privilege policies to reduce the attacker population capable of reaching the vulnerable code path
# Configuration example: blacklist the vulnerable driver until patched
echo "blacklist pcc-cpufreq" | sudo tee /etc/modprobe.d/disable-pcc-cpufreq.conf
sudo update-initramfs -u
sudo reboot
# Verify the module is not loaded after reboot
lsmod | grep pcc_cpufreq
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
