Executive brief
The ucs1002 power supply driver for Linux has a resource cleanup defect that can cause a crash or memory corruption when the device is removed or unbound. A delayed work task is not properly cancelled during driver cleanup, allowing it to execute and access freed memory after the driver's data structures have been deallocated.
Technical details
This is a use-after-free vulnerability in the Linux kernel's ucs1002 power supply driver. The driver's alert IRQ handler queues a delayed work item (health_poll) that reschedules itself in response to bad-health conditions. When the device is unbound, the devm framework frees the alert IRQ (which only synchronizes the handler) but fails to cancel the delayed work, allowing it to run after the driver data is freed. The fix registers the delayed work with devm_delayed_work_autocancel() before the IRQ is requested, ensuring proper cancellation order: IRQ freed first (preventing new queueing), then delayed work cancelled before driver data is freed. The vulnerability requires no user interaction or network access—it is triggered solely by device removal or unbind operations. A patch was committed upstream and backported to stable kernel branches.
Affected products
- Linux Linux kernel affected versions in various stable series (see kernel.org repository)
Timeline
- 2026-09-11: disclosed: CVE published on NVD
- 2026-08-02: patched: Upstream fix committed (commit 609af0ceeaefdfa42cd01dd060b20f2e41f9a232)
- 2026-09-14: patched: Backported to stable kernel branches