CVE-2026-64372

A flaw was found in the Linux kernel's cpufreq subsystem. This vulnerability, a use-after-free and double-free error, occurs during the two-phase _OSC negotiation in the pcc_cpufreq_do_osc() function. A local attacker could exploit this memory corruption to cause a denial of service (DoS) or potentially achieve privilege escalation.

This vulnerability is rated Moderate rather than Important because successful exploitation requires local unprivileged access on systems utilizing the Processor Clocking Control (PCC) cpufreq driver, which relies on specific ACPI platform firmware support. An unprivileged local user would need to trigger ACPI evaluation routines to induce memory corruption, primarily leading to a kernel crash and system denial of service. The affected driver code is not present in default installations of modern Red Hat Enterprise Linux releases such as RHEL 8, 9, and 10.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.