Executive brief
The Linux kernel's power supply driver for the rt9455 charger contains a race condition that can cause the system to access freed memory. When the driver is unloaded or initialization fails, delayed work tasks may attempt to access data structures that have already been released, potentially leading to system crashes or privilege escalation.
Technical details
The vulnerability is a use-after-free flaw in the rt9455 power supply driver's teardown sequence. The threaded IRQ handler queues multiple delayed work items (pwr_rdy_work, max_charging_time_work, batt_presence_work), and some of these can requeue each other. The rt9455_remove() function cancels work items in the wrong order—specifically, it cancels max_charging_time_work before batt_presence_work, allowing the latter to requeue the former after cancellation. Additionally, if rt9455_hw_init() fails after the IRQ is registered, queued work items may execute after the driver data structure (rt9455_info) has been freed. The fix registers a cleanup action via devm_add_action_or_reset() to cancel all delayed work in the correct order and before device resources are released, ensuring work is properly drained in both normal removal and probe error paths.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed