Use-after-free in Linux kernel - CVE-2026-64251

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in pwrseq_debugfs_seq_next() when iterating debugfs seq_file entries. A local user can trigger iteration of the affected debugfs interface to cause a denial of service.

The issue occurs because a device pointer returned to the seq_file framework has its reference dropped before subsequent use.

Affected software

How to mitigate CVE-2026-64251

External References

• https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d
• https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0
• https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec
• https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794

Related Security Bulletins

• Use-after-free in Linux kernel power sequencing driver