CVE-2026-64251

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()<br /> <br /> pwrseq_debugfs_seq_next() declares &amp;#39;next&amp;#39; with __free(put_device),<br /> which causes put_device() to be called on the returned pointer when<br /> the variable goes out of scope. This results in a use-after-free<br /> since the seq_file framework receives a pointer whose reference has<br /> already been dropped.<br /> <br /> Simply removing __free(put_device) would fix the UAF but would leak<br /> the reference acquired by bus_find_next_device(), as stop() only<br /> calls up_read(&amp;pwrseq_sem) and never releases the device reference.<br /> <br /> Fix this by making the reference counting consistent across all<br /> seq_file callbacks, matching the standard pattern used by PCI and<br /> SCSI:<br /> <br /> - start(): use get_device() so it returns a referenced pointer.<br /> - next(): explicitly put_device(curr) to release the previous<br /> device&amp;#39;s reference (no NULL check needed - the seq_file framework<br /> only calls next() while the previous return was non-NULL).<br /> - stop(): put_device(data) to release the last iterated device&amp;#39;s<br /> reference, with a NULL guard since stop() may be called with NULL<br /> when start() returned NULL or next() reached end-of-sequence.