Executive brief
The Linux kernel's fuel gauge driver for the AB8500 power management chip contains a use-after-free vulnerability in its shutdown sequence. Threaded interrupt handlers remain active after the driver's workqueue is destroyed, allowing them to attempt to queue work on freed memory if they fire during shutdown. This can cause a kernel crash or memory corruption during device removal.
Technical details
The vulnerability is a use-after-free in the ab8500_fg_remove() function. The driver destroys its workqueue before devm-managed interrupt handlers are freed; if an interrupt fires in that window, the handler attempts to queue work on the already-destroyed workqueue, leading to a use-after-free. The fix registers the workqueue cleanup through the devm framework, ensuring interrupts are freed first before the workqueue is torn down. The fix also disables rather than cancels pending work items, preventing any callback (including power supply notifications) from re-queuing work after driver shutdown. This vulnerability affects Linux kernel v6.10 and later.
Affected products
- Linux Linux kernel v6.10+
Timeline
- 2026-09-16: disclosed
- 2026-08-04: patched