CVE-2026-64251: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()

pwrseq_debugfs_seq_next() declares 'next' with __free(put_device),
which causes put_device() to be called on the returned pointer when
the variable goes out of scope.  This results in a use-after-free
since the seq_file framework receives a pointer whose reference has
already been dropped.

Simply removing __free(put_device) would fix the UAF but would leak
the reference acquired by bus_find_next_device(), as stop() only
calls up_read(&pwrseq_sem) and never releases the device reference.

Fix this by making the reference counting consistent across all
seq_file callbacks, matching the standard pattern used by PCI and
SCSI:

- start(): use get_device() so it returns a referenced pointer.
- next(): explicitly put_device(curr) to release the previous
  device's reference (no NULL check needed - the seq_file framework
  only calls next() while the previous return was non-NULL).
- stop(): put_device(data) to release the last iterated device's
  reference, with a NULL guard since stop() may be called with NULL
  when start() returned NULL or next() reached end-of-sequence.

The Linux kernel CVE team has assigned CVE-2026-64251 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c and fixed in 6.12.95 with commit ba0b9f04c7a5f9887b8ce672eaf049502c0548ec
	Issue introduced in 6.11 with commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c and fixed in 6.18.38 with commit e91df6d273445c03f5aa302bfe147eda33d45794
	Issue introduced in 6.11 with commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c and fixed in 7.1.3 with commit 73569a44fca2992f0ca4a4c0104069741b9873a0
	Issue introduced in 6.11 with commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c and fixed in 7.2-rc1 with commit 257595adf9dac15ae1edd9d07753fbc576a7583d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64251
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/power/sequencing/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec
	https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794
	https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0
	https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d