CVE-2026-64246 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
Move of_node_put(dn) after the of_match_node() call, which still needs the node pointer. The node reference is correctly released after use.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability represents a classic use-after-free error in the Linux kernel's power management subsystem, specifically affecting the linkstation-poweroff driver implementation. The flaw occurs during the initialization phase of the power reset functionality where the device node reference is improperly managed, creating a scenario where memory that has been freed is still accessed by subsequent operations. The vulnerability manifests when the of_match_node() function attempts to access a device node pointer that has already been released through move of_node_put(dn) occurring after the function call rather than before it.
The technical root cause stems from improper resource management within the kernel's device tree parsing logic, where device node references are not correctly handled during driver initialization sequences. This particular implementation error violates fundamental memory safety principles and creates opportunities for undefined behavior that can potentially lead to system instability or privilege escalation. The issue aligns with CWE-416 which specifically addresses use-after-free vulnerabilities, where a pointer is used after the memory it points to has been freed.
The operational impact of this vulnerability extends beyond simple system crashes, as it affects the reliability of power management operations on Linkstation devices that rely on this specific driver implementation. When the kernel attempts to match device nodes during power-off sequences, the premature release of the device node reference can cause the system to access invalid memory locations, potentially leading to kernel oops, system hangs, or even more severe security implications if attackers can manipulate the timing or conditions under which this occurs. This vulnerability particularly impacts embedded systems and network-attached storage devices that depend on proper power management functionality.
Mitigation strategies for this vulnerability should focus on correcting the resource management sequence within the linkstation_poweroff_init() function to ensure device node references are properly released only after all operations requiring them have completed. The fix involves reordering the memory management operations so that of_match_node() executes before move of_node_put(dn) is called, ensuring proper reference counting and preventing access to freed memory. Security teams should prioritize patching this vulnerability in production environments where Linkstation devices operate, particularly in critical infrastructure deployments where power management reliability is paramount.
This type of vulnerability demonstrates the importance of careful resource management in kernel space code and aligns with ATT&CK technique T1068 which covers local privilege escalation through kernel exploits. The vulnerability also highlights the need for comprehensive testing of device tree parsing operations and proper adherence to kernel development best practices regarding reference counting and memory lifecycle management. Organizations should implement automated testing procedures that specifically target device tree initialization sequences and power management drivers to identify similar issues before they can be exploited in production environments.