Executive brief
A vulnerability was identified in the Linux kernel's power supply driver for wm97xx hardware. This issue occurs during the system startup process where the software begins listening for hardware signals (interrupts) before it has finished setting up the necessary data structures to handle them. If a hardware event occurs during this brief window, the system may crash, leading to a denial of service.
Technical details
A race condition exists in the `wm97xx_bat_probe()` function of the Linux kernel's wm97xx battery driver. The driver calls `request_irq()` to register an interrupt handler before it has successfully initialized and registered the `power_supply` handle via `power_supply_register()`. If an interrupt is triggered by the hardware (e.g., a charger state change) between these two calls, the interrupt handler `wm97xx_bat_update()` will invoke `power_supply_changed()` using an uninitialized handle. This results in a NULL pointer dereference and a subsequent kernel oops/system crash. The fix involves reordering the probe sequence to ensure the power supply handle is fully registered before the IRQ is requested.
Affected products
- Linux Linux Kernel wm97xx battery driver
Timeline
- 2025-12-20: other: Patch authored
- 2026-01-12: patched: Patch committed to stable tree
- 2026-05-27: advisory: CVE published
References
- https://git.kernel.org/stable/c/39fe0eac6d755ef215026518985fcf8de9360e9e
- https://git.kernel.org/stable/c/3d7b5391bb95505b3581c1fb77150c467ab92864
- https://git.kernel.org/stable/c/438f9a303ea8b55162b2d5376490c2ab3ec165a0
- https://git.kernel.org/stable/c/86183153c299e8bb1839e717286d6c6f39508a59
- https://git.kernel.org/stable/c/93bdf715d33cf5ee01c58e8546c2469c71ce082a
- https://git.kernel.org/stable/c/9b7d77cb046b4487e8e511e04e62b6f416ce845c
- https://git.kernel.org/stable/c/c0def811ad8d642dca9b6d31a198cc39f5f90837