Executive brief
The Linux kernel's charger-manager driver contains a use-after-free vulnerability in its power supply management code. An attacker with local access to sysfs can write to the externally_control attribute and trigger a crash or potential code execution by dereferencing freed memory handles. This affects systems relying on the charger-manager for battery and charging management, potentially leading to denial of service or local privilege escalation.
Technical details
The charger-manager driver in the Linux kernel suffers from a use-after-free vulnerability in its power supply and regulator management logic. The vulnerability exists in the probe and removal paths where sysfs entries are exposed before regulator handles are acquired (in probe) and freed before sysfs teardown (in removal). An attacker with local access can write to the externally_control sysfs attribute, triggering charger_externally_control_store() which calls try_charger_enable() and dereferences already-freed regulator consumer handles. The fix reorders initialization to acquire regulators before exposing sysfs, and ensures sysfs is torn down before regulators are released. The vulnerability requires local access to sysfs but can lead to kernel code execution or denial of service.
Affected products
- Linux Linux kernel affected versions unknown
Timeline
- 2026-09-11: disclosed: CVE-2026-89472 published