Executive brief
A vulnerability exists in the Linux kernel's support for the Richtek RT9455 battery charger. Due to a technical error in how the system handles hardware signals (interrupts) during startup or shutdown, the system may attempt to access memory that has already been cleared. This can lead to unpredictable system crashes or silent data corruption, potentially impacting the reliability and availability of devices using this specific hardware.
Technical details
A use-after-free (UAF) vulnerability exists in the rt9455 battery charger driver (drivers/power/supply/rt9455_charger.c) within the Linux kernel. The root cause is the improper ordering of managed resource allocation (`devm_`). Specifically, the IRQ is requested before the `power_supply` handle is registered. Because `devm_` resources are released in reverse order of allocation, the `power_supply` handle is freed before the IRQ handler is unregistered during driver removal. This creates a race condition where an interrupt firing after the handle is freed causes `power_supply_changed()` to access invalid memory. A similar race exists during `probe()` where an interrupt might fire before the handle is initialized. The fix reorders these calls to ensure the IRQ is requested only after the power supply handle is fully registered.
Affected products
- Linux Linux Kernel Richtek RT9455 battery charger driver (rt9455)
Timeline
- 2025-12-20: other: Patch authored
- 2026-06-03: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2178dc65d45e2f7bcaa8af8d80d100419bdab251
- https://git.kernel.org/stable/c/62d753b916bd500bb269b7078cdab73198ab4718
- https://git.kernel.org/stable/c/64e15155095f39f4dec9b4659da1238ef8fc54d4
- https://git.kernel.org/stable/c/721449a15170fc5f028a7576d7f65b9f60d53482
- https://git.kernel.org/stable/c/a39f8f06216f73ef40e71e2fe4ad071964c1fd36
- https://git.kernel.org/stable/c/af261f218a7606f93d2c786353d60bb4feb56ef0
- https://git.kernel.org/stable/c/d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc