CVE-2026-64251

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()

pwrseq_debugfs_seq_next() declares 'next' with __free(put_device),

which causes put_device() to be called on the returned pointer when

the variable goes out of scope. This results in a use-after-free

since the seq_file framework receives a pointer whose reference has

already been dropped.

Simply removing __free(put_device) would fix the UAF but would leak

the reference acquired by bus_find_next_device(), as stop() only

calls up_read(&pwrseq_sem) and never releases the device reference.

Fix this by making the reference counting consistent across all

seq_file callbacks, matching the standard pattern used by PCI and

SCSI:

- start(): use get_device() so it returns a referenced pointer.

- next(): explicitly put_device(curr) to release the previous

device's reference (no NULL check needed - the seq_file framework

only calls next() while the previous retu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References