PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64246 Linux CVE debrief

A use-after-free vulnerability was found in the linkstation_poweroff_init() function of the Linux kernel. The issue arises from the incorrect placement of of_node_put(dn), which should be moved after the of_match_node() call that still requires the node pointer. This ensures the node reference is correctly released after use. The vulnerability allows for potential local privilege escalation and has been addressed by Linux kernel maintainers with several patches available in the kernel stable branches. Affected Linux kernel versions range from 5.15 to 7.1.3. Users of these versions should review and apply patches to mitigate the vulnerability. The CVSS score is 7.8 (High). Security teams should prioritize patching and monitor Linux kernel updates for future security advisories. Evidence is limited to public CVE and NVD records, and defenders should verify patch application and system exposure with Linux kernel maintainers and distribution vendors.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-24
Original CVE updated
2026-08-17
Advisory published
2026-07-24
Advisory updated
2026-08-17

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux kernel versions 5.15 to 7.1.3 should review and apply patches to mitigate the vulnerability. Security teams and vulnerability management teams should prioritize patching and monitor Linux kernel updates for future security advisories.

Technical summary

The CVE-2026-64246 vulnerability is a use-after-free issue in the linkstation_poweroff_init() function of the Linux kernel. The flaw occurs due to the premature release of the node pointer, leading to potential local privilege escalation. The CVSS score is 7.8 (High). Affected Linux kernel versions range from 5.15 to 7.1.3. Linux kernel maintainers have addressed this issue with several patches available in the kernel stable branches.

Defensive priority

High priority due to potential local privilege escalation

Recommended defensive actions

  • Apply patches from Linux kernel stable branches
  • Review and update Linux kernel versions to ensure affected versions are patched
  • Monitor Linux kernel updates for future security advisories
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability details are based on the official CVE and NVD records. The Linux kernel maintainers have addressed this issue with several patches available in the kernel stable branches. Evidence is limited to public CVE and NVD records. Defenders should verify patch application and system exposure with Linux kernel maintainers and distribution vendors, and review Linux kernel versions to ensure affected versions are patched.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64246 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64246

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64246 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64246

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2205275be9be981e70ff29610b0117d8853fac70

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3928ae803dee044b01076c478c279c0bd54164cd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8eec545cde69e46e9a1d2b7d915ce4f5df85b3bd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/93c7ee139721936b6fa717572e74d3994603ae13

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c04d606f8b35ee7d3ed243f63893a607e9d6c0bc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cdda7d384c05485a232ae9a849f6445accb095bf

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d109e72f3fbccb540473285d17d7519584f7f76e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.