Executive brief
The Linux kernel contains a use-after-free vulnerability in the Qualcomm battery manager driver (qcom_battmgr), which manages power supply information for Qualcomm devices. An attacker with local access could potentially trigger a kernel crash or execute code with kernel privileges by exploiting the faulty memory management in the battery status notification handler.
Technical details
The vulnerability is a use-after-free in qcom_battmgr_pdr_notify(), a PDR (Protection Domain Restart) notification handler that queues enable_work to recover the battery manager when the PMIC GLINK service restarts. The worker accesses the battmgr structure via container_of() to issue firmware requests, but because the PMIC GLINK client remains on the client list until its devres release runs, a PDR notification can queue additional work that accesses battmgr after devres has freed it. The fix registers enable_work as device-managed using devm_work_autocancel() before allocating the PMIC GLINK client, ensuring proper cleanup ordering: the client is released first (preventing further notifications), then the work is cancelled before battmgr is freed. This was discovered via static analysis and resolved in Linux kernel commit 4e40befedfc8ed86f44e1f81df92d13c149c9f8d.
Affected products
- Linux Linux kernel Versions up to and including the fix commit 4e40befedfc8ed86f44e1f81df92d13c149c9f8d
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Fix commit 4e40befedfc8ed86f44e1f81df92d13c149c9f8d merged; advisory published after patch availability