CVE-2026-45867 Overview
CVE-2026-45867 is a use-after-free vulnerability in the Linux kernel's act8945a power supply driver. The flaw stems from incorrect ordering of devm_ resource allocations in the driver's probe function. The interrupt request is issued before the power_supply handle registration, which causes the handle to be deallocated before the interrupt handler during device removal. An IRQ firing during this window invokes power_supply_changed() on a freed handle. The result is a kernel crash or silent memory corruption. A similar race exists during probe(), where an early interrupt can access an uninitialized handle.
Critical Impact
Triggering the race condition causes kernel memory corruption or a system crash through use-after-free on the power_supply handle.
Affected Products
- Linux kernel power: supply: act8945a driver
- Stable kernel branches receiving the referenced fix commits
- Embedded and IoT systems using the Active-Semi ACT8945A PMIC
Discovery Timeline
- 2026-05-27 - CVE CVE-2026-45867 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45867
Vulnerability Analysis
The act8945a charger driver uses managed device resources through the devm_ API family. Managed resources are released in reverse order of allocation when the device is unbound. The driver calls devm_request_irq() before devm_power_supply_register(). During teardown, the power_supply handle is freed first, while the IRQ handler remains registered.
An interrupt arriving in this narrow window calls power_supply_changed() with a dangling pointer. The function dereferences freed memory, which leads to undefined kernel behavior. This is a classic use-after-free [CWE-416] caused by lifetime mismanagement between two managed resources.
Root Cause
The root cause is incorrect ordering of resource registration in the driver probe path. The devm_ cleanup model assumes that resources holding references to one another are registered in dependency order. Registering the IRQ before the power_supply handle inverts this dependency. The interrupt handler can therefore outlive the object it operates on during removal, and can also fire before the object is fully initialized during probe.
Attack Vector
Exploitation requires the ability to trigger device removal or probe events on a system using the ACT8945A PMIC. Local attackers with privileges to bind, unbind, or hotplug the device may race the IRQ delivery against teardown. Physical events such as charger insertion or removal can also generate the interrupts needed to land in the use-after-free window. The vulnerability is not remotely reachable and is limited to platforms incorporating this specific power management integrated circuit.
The upstream fix reorders the probe sequence so that devm_request_irq() runs after power_supply registration. See the patch series at the Kernel Git Commit 83c1bd4 and Kernel Git Commit f27eb76 for the implementation.
Detection Methods for CVE-2026-45867
Indicators of Compromise
- Kernel oops or panic messages referencing power_supply_changed in the call stack on systems using the act8945a driver.
- KASAN reports identifying use-after-free reads against power_supply objects during device unbind or shutdown.
- Unexplained kernel memory corruption shortly after charger driver removal or module unload events.
Detection Strategies
- Audit kernel versions against the fixed commits listed in the Kernel Git Commit 0768e85 patch series to identify unpatched builds.
- Enable KASAN on test images for embedded targets to surface the use-after-free during driver unbind testing.
- Monitor dmesg and journal logs for repeated act8945a IRQ activity coinciding with module unload operations.
Monitoring Recommendations
- Forward kernel logs to a centralized logging pipeline and alert on BUG: KASAN or general protection fault entries.
- Track udev unbind events for power supply class devices on fleets that include ACT8945A-based hardware.
- Correlate kernel crash dumps with firmware updates or charger state transitions to identify race-window exposure.
How to Mitigate CVE-2026-45867
Immediate Actions Required
- Update affected systems to a Linux kernel release containing the upstream act8945a fix commits referenced in the NVD entry.
- Inventory embedded and IoT devices that include the Active-Semi ACT8945A PMIC and prioritize patch deployment for those assets.
- Restrict local privileges that allow driver unbind or module unload operations on production systems pending update.
Patch Information
The fix moves devm_request_irq() after devm_power_supply_register() so the IRQ handler is torn down before the power_supply handle is freed. Patches are available across multiple stable branches via the commits 0768e85, 3291c51, 697bb5d, 76a42ba, 83c1bd4, d023ef9, f27eb76, and f2a0777.
Workarounds
- Disable the act8945a driver in the kernel configuration on systems that do not require ACT8945A PMIC support.
- Avoid runtime unbind or module unload of the act8945a driver on production hardware until the patched kernel is deployed.
- Limit user accounts permitted to interact with /sys/bus/.../bind and /sys/bus/.../unbind interfaces for power supply devices.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
