Executive brief
A synchronization issue was identified in the Linux kernel's power regulator subsystem. This component manages how power is supplied to various hardware parts of a computer or device. If a specific error occurs while setting up these power supplies, it could lead to internal system instability or crashes, potentially affecting the overall reliability of the device.
Technical details
A locking vulnerability exists in the Linux kernel's regulator subsystem within the `regulator_resolve_supply()` function. When the late enabling of a supply regulator fails, the error path incorrectly calls `_regulator_put()` without holding the required `regulator_list_mutex`, triggering a lockdep warning and potential race conditions. Additionally, the code lacked sufficient locking to prevent concurrent access to the regulator device (`rdev`) while clearing the supply pointer. The fix involves switching to the thread-safe `regulator_put()` and implementing proper locking using `regulator_lock_two()` to ensure atomic updates to the supply pointer.
Affected products
- Linux Linux kernel All versions prior to the fix in regulator core
Timeline
- 2026-01-09: patched: Initial patch submitted to the Linux kernel mailing list
- 2026-06-03: disclosed: CVE published to the NVD