Executive brief
The Linux kernel's cpcap-battery driver manages power supply detection on certain mobile devices. A code defect causes the driver to leak references to battery configuration memory devices, preventing proper cleanup and potentially exhausting system resources over time through repeated battery detection attempts.
Technical details
The vulnerability is a resource leak (CWE-772) in the cpcap_battery_detect_battery_type() function within drivers/power/supply/cpcap-battery.c. When an nvmem device is obtained via nvmem_device_find(), the corresponding reference is not released with nvmem_device_put() on either success or read-failure paths, causing a permanent reference leak. The driver's retry logic on subsequent battery property reads compounds this issue, preventing the nvmem device from ever being freed. The vulnerability requires no authentication or network access—it is triggered locally during normal battery detection operations. The fix adds proper nvmem_device_put() calls to ensure references are released in all code paths. A patch was committed upstream in June 2026 and backported to stable kernels.
Affected products
- Linux Linux kernel all versions with cpcap-battery driver (since commit fd46821e85de)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-06-03: patched: Upstream fix committed by Sebastian Reichel
- 2026-04-24: other: Original patch submitted by Ma Ke