In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existing buffer to write into, the second call wrote into freed memory (use-after-free). The subsequent kfree(output.pointer) at out_free then freed the same pointer a second time (double free). Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, so ACPICA allocates a fresh buffer for each phase independently.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29 cve-icon
https://git.kernel.org/stable/c/266d3dd8b757b48a576e90f018b51f7b7563cc32 cve-icon
https://git.kernel.org/stable/c/5cdb25f144b101083d8bf3fd023ad87fbe6850d7 cve-icon
https://git.kernel.org/stable/c/632666a63116d8061c62a988d1ca39dcd6d27c9b cve-icon
https://git.kernel.org/stable/c/6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7 cve-icon
https://git.kernel.org/stable/c/8e454e9d0bc03446d610ee49abec9dfd424f6541 cve-icon
https://git.kernel.org/stable/c/982c9f92d57bda2b769851ff6d90d43dcf5f3734 cve-icon
https://git.kernel.org/stable/c/a36ca93a8ba57464e521d70a337d37f069064111 cve-icon
https://lore.kernel.org/linux-cve-announce/2026072523-CVE-2026-64372-794b@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-64372 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-64372 cve-icon
History

Mon, 03 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-590

Wed, 29 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-763
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-590

Mon, 27 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existing buffer to write into, the second call wrote into freed memory (use-after-free). The subsequent kfree(output.pointer) at out_free then freed the same pointer a second time (double free). Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, so ACPICA allocates a fresh buffer for each phase independently.
Title cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:24.733Z

Updated: 2026-07-27T05:00:01.364Z

Reserved: 2026-07-19T15:36:31.783Z

Link: CVE-2026-64372

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64372 - Bugzilla