Executive brief
The Linux kernel's charger-manager driver contains a memory resource leak in its battery charge-level monitoring function. When checking if a battery is fully charged based on voltage, the driver fails to properly release a reference to the power supply object in certain code paths, causing the reference counter to leak. This can lead to incremental memory pressure and potential device instability over time.
Technical details
This is a reference-count leak vulnerability in the `is_full_charged()` function within the charger-manager driver (drivers/power/supply/charger-manager.c). The function calls `power_supply_get_by_name()` to obtain a reference to the fuel gauge power supply object. If a voltage check (`uV >= desc->fullbatt_uV`) succeeds, the function returns `true` directly without calling `power_supply_put()` to decrement the reference count, leaking the object reference. The vulnerability is local to the kernel and requires the charger-manager device to be active. The fix involves replacing the early return with a flag-based approach that ensures the reference is always released via a centralized `out` label before the function exits.
Affected products
- Linux Linux kernel Linux kernel (charger-manager driver in drivers/power/supply/charger-manager.c)
Timeline
- 2026-08-15: disclosed
- 2026-06-11: patched: Fix committed by WenTao Liang
- 2026-07-24: other: Fix merged into stable kernels by Greg Kroah-Hartman