CVE-2026-45867 Details

A use-after-free vulnerability has been identified in the Linux kernel's power supply component, specifically within the act8945a charger driver. This issue arises because the 'devm_' variant for requesting interrupts is used before the 'devm_' variant for allocating or registering the power_supply handle. As a result, the power_supply handle is deallocated or unregistered before the interrupt handler is properly set up. During the removal process, this creates a race condition where an interrupt can be triggered just after the power_supply handle has been freed, but before the corresponding unregistration of the interrupt handler has occurred. Consequently, the interrupt handler may call 'power_supply_changed()' with a freed power_supply handle, leading to a system crash or silent memory corruption. Additionally, a similar situation can occur during the 'probe()' phase, where an interrupt might fire before the power_supply handle is registered, causing the handler to use an uninitialized power_supply reference.

The vulnerability has been fixed by modifying the act8945a charger driver to request the IRQ after the power_supply handle has been registered. Users should apply the latest patches available in the Linux kernel stable tree to address this issue.