Use-After-Free Vulnerability in Linux Kernel Pwrseq Module

CVE-2026-64251

What is CVE-2026-64251?

A use-after-free vulnerability exists in the Linux kernel’s pwrseq module, specifically in the pwrseq_debugfs_seq_next() function. This issue arises due to improper reference counting when handling device pointers. The function improperly manages the life cycle of device references, leading to potential memory access violations. This flaw can be exploited if the seq_file framework processes a pointer that has already been deallocated. To remediate this, the reference counting has been aligned with typical practices used in similar frameworks like PCI and SCSI, ensuring that only valid device references are maintained throughout the sequence. This fix encompasses modifications in the start(), next(), and stop() callbacks to handle device references securely.

References