CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates local access and low privileges are required. No user interaction is required.

Q: What security impact could successful exploitation have?

The CVSS vector rates confidentiality, integrity, and availability impacts as high. The flaw involves both use-after-free and double-free behavior in the kernel.

Q: Which systems are identified as affected?

The provided data identifies the Linux kernel and Microsoft azl3 kernel 6.6.144.1-1. No broader version range or configuration criteria is provided.

Q: How is the vulnerable memory handling corrected?

After the first _OSC evaluation result is freed, the fix resets output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER. This causes ACPICA to allocate a new buffer for the second evaluation phase rather than writing to or freeing the prior buffer again.

Published Jul 25, 2026

Updated

cpufreq: pcc: fix use-after-free and double free in OSC evaluation

Affected Software

9 affected componentsFixes available

Linux Linux kernel

Microsoft azl3 kernel 6.6.144.1-1<6.6.145.2-1

6.6.145.2-1

Linux Linux kernel>=2.6.34<5.10.261

Linux Linux kernel>=5.11<5.15.212

Linux Linux kernel>=5.16<6.1.178

Linux Linux kernel>=6.2<6.6.145

Linux Linux kernel>=6.7<6.12.96

Linux Linux kernel>=6.13<6.18.39

Linux Linux kernel>=6.19<7.1.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1
Upgrade
Upgrade Linux kernel (ACPICA) to a version that resolves this vulnerability.
Fixed in resolved
Compensating control
As a mitigation, ensure the ACPICA/A C P I _OSC evaluation path cannot be triggered by untrusted firmware inputs until the kernel fix is applied.

Event History

Jul 25, 2026

CVE Published

via MITRE·08:50 AM

Data Sourced

via MITRE·08:50 AM

DescriptionSeverity

Data Sourced

via NVD·10:17 AM

RemedyDescriptionSeverityWeaknessAffected Software

Jul 26, 2026

Data Sourced

via Microsoft·08:12 AM

DescriptionSeverityWeaknessAffected Software

Updated

via Microsoft·08:12 AM

DescriptionSeverity

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates local access and low privileges are required. No user interaction is required.

What security impact could successful exploitation have?

The CVSS vector rates confidentiality, integrity, and availability impacts as high. The flaw involves both use-after-free and double-free behavior in the kernel.

Which systems are identified as affected?

The provided data identifies the Linux kernel and Microsoft azl3 kernel 6.6.144.1-1. No broader version range or configuration criteria is provided.

How is the vulnerable memory handling corrected?

After the first _OSC evaluation result is freed, the fix resets output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER. This causes ACPICA to allocate a new buffer for the second evaluation phase rather than writing to or freeing the prior buffer again.

CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What security impact could successful exploitation have?

Which systems are identified as affected?

How is the vulnerable memory handling corrected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What security impact could successful exploitation have?

Which systems are identified as affected?

How is the vulnerable memory handling corrected?