7.8

CVE-2026-64372

cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
two-phase _OSC negotiation. Between the two calls it freed
output.pointer but left output.length unchanged. Since
acpi_evaluate_object() treats a non-zero length with a non-NULL
pointer as an existing buffer to write into, the second call wrote
into freed memory (use-after-free). The subsequent kfree(output.pointer)
at out_free then freed the same pointer a second time (double free).

Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
after freeing the first result, so ACPICA allocates a fresh buffer for
each phase independently.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.34 < 5.10.261
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.212
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.178
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.145
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.96
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.39
Linux ≫ Linux Kernel Version >= 6.19 < 7.1.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.026
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/8e454e9d0bc03446d610ee49abec9dfd424f6541
Patch
https://git.kernel.org/stable/c/632666a63116d8061c62a988d1ca39dcd6d27c9b
Patch
https://git.kernel.org/stable/c/5cdb25f144b101083d8bf3fd023ad87fbe6850d7
Patch
https://git.kernel.org/stable/c/982c9f92d57bda2b769851ff6d90d43dcf5f3734
Patch
https://git.kernel.org/stable/c/a36ca93a8ba57464e521d70a337d37f069064111
Patch
https://git.kernel.org/stable/c/6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7
Patch
https://git.kernel.org/stable/c/0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29
Patch
https://git.kernel.org/stable/c/266d3dd8b757b48a576e90f018b51f7b7563cc32
Patch