Executive brief
A vulnerability was identified in the Linux kernel's Goldfish battery driver, which is commonly used in Android emulators. A race condition during driver initialization or removal could allow an interrupt to trigger while the power supply component is in an invalid state. This can lead to a system crash or memory corruption, potentially impacting the stability and availability of the virtualized environment.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/power/supply/goldfish_battery.c due to the use of devm_ functions in an incorrect order. The driver requested an IRQ before registering the power_supply handle. Because devm_ resources are released in reverse order of allocation, the power_supply handle is freed before the IRQ handler is unregistered during driver removal. This creates a race condition where an interrupt firing after the handle is freed causes power_supply_changed() to access invalid memory. A similar race exists during probe() where an interrupt could fire before the handle is initialized. An attacker with local access could potentially trigger driver removal or specific power events to cause a denial-of-service (system crash) or memory corruption.
Affected products
- Linux Linux Kernel All versions prior to the fixed stable releases (e.g., 6.1, 6.6, 6.12, 6.13)
Timeline
- 2025-12-20: other: Initial patch authored
- 2026-05-27: advisory: CVE-2026-45936 published
- 2026-02-26: patched: Fix committed to stable trees
References
- https://git.kernel.org/stable/c/0b29ffe4090a3fc7a7649de20e1eb1e53adddac7
- https://git.kernel.org/stable/c/33751e28842bf5aee5ef7b2b8d5e456a069095cb
- https://git.kernel.org/stable/c/4350505e82b4f972ddb788e1c712c557c38859d0
- https://git.kernel.org/stable/c/589d4fe56713c6344cd9f8939f9c7621c85f0966
- https://git.kernel.org/stable/c/77ea437faa4c06362e3ecfd2d7264eaa7ac1e82c
- https://git.kernel.org/stable/c/8c89aade8335e26a6a7dcda18992d15f51943927
- https://git.kernel.org/stable/c/b2ce982e2e0c888dc55c888ad0e20ea04daf2e6b