CVE-2026-64372 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existing buffer to write into, the second call wrote into freed memory (use-after-free). The subsequent kfree(output.pointer) at out_free then freed the same pointer a second time (double free).
Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, so ACPICA allocates a fresh buffer for each phase independently.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability described represents a critical memory safety issue within the Linux kernel's cpufreq subsystem, specifically affecting the PCC (Platform Communication Channel) CPU frequency driver. This flaw exists in the pcc_cpufreq_do_osc() function which implements the two-phase _OSC (Operating System Capabilities) negotiation protocol as defined by the ACPI specification. The vulnerability manifests through improper memory management during the evaluation process where the kernel fails to properly reset buffer pointers between sequential acpi_evaluate_object() calls, creating conditions that can lead to arbitrary code execution and system instability.
The technical root cause of this vulnerability stems from a flawed sequence in memory deallocation and buffer management within the _OSC evaluation process. When pcc_cpufreq_do_osc() executes acpi_evaluate_object() twice for the two-phase negotiation, it first frees the output.pointer memory location but neglects to reset the associated output.length field accordingly. This inconsistency creates a dangerous state where the second call to acpi_evaluate_object() interprets the non-zero length field as indicating an existing buffer that should be written into, despite the pointer having already been freed. This use-after-free condition allows for memory corruption that can be exploited by malicious actors to execute arbitrary code with kernel privileges, representing a direct violation of the principle of least privilege and memory safety.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable complete system compromise through privilege escalation techniques. Attackers could leverage this flaw to gain elevated privileges within the kernel space, bypassing traditional security boundaries that protect against user-level exploits. The double free condition that occurs during cleanup further amplifies the risk by creating opportunities for heap-based memory corruption patterns that are particularly challenging to detect and prevent. This vulnerability affects systems running Linux kernels with PCC CPU frequency support and represents a significant threat to server and workstation environments where kernel-level security is paramount.
The mitigation strategy for this vulnerability requires immediate application of the kernel patch that resets output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, ensuring that ACPICA allocates fresh buffers independently for each phase of the _OSC negotiation. This approach aligns with established security practices for memory management in kernel space and follows the principles outlined in CWE-415, which addresses double free vulnerabilities, and CWE-416, which covers use-after-free conditions. The fix operates at the level of the underlying ACPI subsystem and requires no changes to user-space applications or system configurations, making it a straightforward and effective solution that maintains backward compatibility while eliminating the memory safety risks.
This vulnerability demonstrates the critical importance of proper resource management in kernel-level code and highlights how seemingly minor oversight in buffer handling can create severe security implications. The fix addresses fundamental issues related to the ATT&CK technique T1068, which involves exploiting local privileges through kernel vulnerabilities, by ensuring that memory operations follow established safety protocols. Organizations should prioritize immediate patch deployment across affected systems and monitor for potential exploitation attempts that may leverage this vulnerability during the transition period before full remediation is achieved.