Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-25T00:00:00 kernel: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-763

In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existing buffer to write into, the second call wrote into freed memory (use-after-free). The subsequent kfree(output.pointer) at out_free then freed the same pointer a second time (double free). Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, so ACPICA allocates a fresh buffer for each phase independently.

A flaw was found in the Linux kernel's cpufreq subsystem. This vulnerability, a use-after-free and double-free error, occurs during the two-phase _OSC negotiation in the `pcc_cpufreq_do_osc()` function. A local attacker could exploit this memory corruption to cause a denial of service (DoS) or potentially achieve privilege escalation.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Affected kernel Red Hat Enterprise Linux 7 Affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-64372 https://nvd.nist.gov/vuln/detail/CVE-2026-64372 https://lore.kernel.org/linux-cve-announce/2026072523-CVE-2026-64372-794b@gregkh/T