CVE-2026-64372 Details
Description
In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existing buffer to write into, the second call wrote into freed memory (use-after-free). The subsequent kfree(output.pointer) at out_free then freed the same pointer a second time (double free). Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, so ACPICA allocates a fresh buffer for each phase independently.
A use-after-free and double free vulnerability has been identified in the Linux kernel's Processor Clocking Control (PCC) interface driver, specifically within the cpufreq component. This issue arises during the two-phase _OSC negotiation process, where the function pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice. Between these calls, it frees the output.pointer but fails to update the output.length. As a result, the second call writes into memory that has already been freed, creating a use-after-free condition. The subsequent call to kfree(output.pointer) then attempts to free the same pointer again, leading to a double free vulnerability.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version of the stable Linux kernel where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29 | kernel.org | Patch |
| https://git.kernel.org/stable/c/266d3dd8b757b48a576e90f018b51f7b7563cc32 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5cdb25f144b101083d8bf3fd023ad87fbe6850d7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/632666a63116d8061c62a988d1ca39dcd6d27c9b | kernel.org | Patch |
| https://git.kernel.org/stable/c/6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8e454e9d0bc03446d610ee49abec9dfd424f6541 | kernel.org | Patch |
| https://git.kernel.org/stable/c/982c9f92d57bda2b769851ff6d90d43dcf5f3734 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a36ca93a8ba57464e521d70a337d37f069064111 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.34, < 5.10.261 >= 5.11, < 5.15.212 >= 5.16, < 6.1.178 >= 6.2, < 6.6.145 >= 6.7, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |