Executive brief
A vulnerability was identified in the Linux kernel's power supply driver for certain hardware components. A race condition during system startup or shutdown could cause the system to crash or experience memory corruption. This occurs because the system may attempt to process power-related signals using memory that has already been cleared or has not yet been set up.
Technical details
A use-after-free (UAF) vulnerability exists in the ab8500_charger driver within the Linux kernel power supply subsystem. The issue stems from the incorrect ordering of resource allocation using the devm_ framework. Specifically, the driver requested IRQs before registering the power_supply handle. Because devm_ releases resources in reverse order of allocation, the power_supply handle is freed before the IRQ handler is unregistered during driver removal. This creates a race condition where an interrupt firing after the handle is freed causes power_supply_changed() to be called with a stale pointer. A similar race exists during probe() where an interrupt may fire before the handle is initialized. The fix involves reordering the probe sequence to ensure IRQs are requested only after the power_supply handle is fully registered.
Affected products
- Linux Linux kernel versions including 1c1f13a006ed
Timeline
- 2025-12-20: other: Patch authored
- 2026-05-27: advisory: CVE published
References
- https://git.kernel.org/stable/c/43cbb78ee047b9b12d096d40e3be265969d4c1f8
- https://git.kernel.org/stable/c/46dbda27b028d78087667e8280966b99cec015ca
- https://git.kernel.org/stable/c/551672981fe227122258a25a385a05f5c0746ad6
- https://git.kernel.org/stable/c/709db4b476e254579d9c48ec34d397a41ca0c407
- https://git.kernel.org/stable/c/847eeb6c0efcd76c7def73857cf798a4fcd8f79b
- https://git.kernel.org/stable/c/c4af8a98bb52825a5331ae1d0604c0ea6956ba4b
- https://git.kernel.org/stable/c/f50433f2603def08b21a4bf2fd238687fb5cbde9