CVE-2026-45869: Linux Kernel Race Condition Vulnerability

CVE-2026-45869 Overview

CVE-2026-45869 is a NULL pointer dereference vulnerability in the Linux kernel's wm97xx power supply driver. The flaw exists in the driver's probe() function, which calls request_irq() before allocating and registering the power_supply handle. If an interrupt fires during this race window, the handler invokes power_supply_changed() from wm97xx_bat_update() using an uninitialized power_supply handle, causing a NULL pointer dereference and kernel crash.

The issue has been resolved upstream by reordering operations so the IRQ is requested only after the power_supply handle is registered.

Critical Impact
A race condition during driver initialization can trigger a kernel NULL pointer dereference, resulting in a denial of service through kernel panic on affected systems.

Affected Products

Linux kernel power: supply: wm97xx driver (multiple stable branches)
Systems using Wolfson WM97xx touchscreen/battery codec hardware
Distributions shipping kernels prior to the patch commits referenced below

Discovery Timeline

2026-05-27 - CVE-2026-45869 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45869

Vulnerability Analysis

The vulnerability is a race-condition driven NULL pointer dereference [CWE-476] in the wm97xx_battery driver located under drivers/power/supply/. During device probing, the driver registers an interrupt handler with request_irq() before completing the allocation and registration of the power_supply structure used by the battery monitoring code path.

If the hardware asserts an interrupt between request_irq() returning and power_supply_register() completing, the kernel dispatches the handler immediately. The handler ultimately calls wm97xx_bat_update(), which dereferences the not-yet-initialized power_supply pointer via power_supply_changed(). The result is a kernel oops and system instability.

The upstream fix moves the request_irq() call to occur after power_supply_register() succeeds. Because the IRQ is now the last resource acquired in probe(), the prior error-unwind path for freeing the IRQ is removed, and a new error path is added to unregister the power_supply handle if IRQ registration fails.

Root Cause

The root cause is improper initialization ordering in the driver's probe sequence. The interrupt source is enabled before the data structures the interrupt handler depends on are valid. This creates a window where any incoming IRQ causes the handler to operate on an uninitialized power_supply handle.

Attack Vector

Exploitation requires the affected wm97xx hardware and the ability to trigger an interrupt during driver initialization. The condition is primarily a reliability and stability issue rather than a remote attack vector, manifesting as a kernel crash. Local users with the capability to load or rebind the driver could potentially provoke the race on hardware that generates interrupts during boot.

No public proof-of-concept exploit code is available. The vulnerability is described in the upstream commit messages referenced in the security advisories.

Detection Methods for CVE-2026-45869

Indicators of Compromise

Kernel oops or panic messages referencing power_supply_changed, wm97xx_bat_update, or wm97xx_battery in dmesg or /var/log/kern.log
Unexpected system reboots or hangs occurring during boot on devices using WM97xx codecs
Stack traces showing NULL pointer dereference within the power: supply subsystem

Detection Strategies

Inventory running kernel versions across Linux endpoints and compare against the fixed commit hashes (39fe0ea, 3d7b539, 438f9a3, 8618315, 93bdf71, 9b7d77c, c0def81, dfaf235)
Audit loaded kernel modules with lsmod | grep wm97xx to identify systems where the vulnerable driver is active
Collect and centrally aggregate kernel logs to spot recurring NULL pointer dereferences originating from the power supply subsystem

Monitoring Recommendations

Forward kern.log and dmesg output to a central logging or SIEM platform for pattern analysis
Alert on repeated kernel oops events tagged with wm97xx or power_supply_changed
Track kernel package versions through configuration management to confirm patch deployment status

How to Mitigate CVE-2026-45869

Immediate Actions Required

Apply the upstream stable kernel patches that reorder request_irq() to occur after power_supply_register() in the wm97xx_battery driver
Update affected systems to a kernel release that includes one of the fix commits referenced in the Kernel Git Commit 39fe0ea advisory
Prioritize patching embedded and industrial systems that ship with WM97xx hardware, where uptime expectations are high

Patch Information

The vulnerability is resolved across multiple stable kernel branches. Reference commits include Kernel Git Commit 3d7b539, Kernel Git Commit 438f9a3, Kernel Git Commit 8618315, Kernel Git Commit 93bdf71, Kernel Git Commit 9b7d77c, Kernel Git Commit c0def81, and Kernel Git Commit dfaf235. Consult your Linux distribution's security advisories for backported package versions.

Workarounds

Blacklist the wm97xx_battery kernel module on systems where the WM97xx battery monitoring functionality is not required
Restrict the ability to load or rebind kernel modules to root-only contexts to reduce local exposure
Where hardware permits, defer enabling the WM97xx codec interrupt source until after userspace has confirmed driver initialization completed cleanly

bash

# Blacklist the vulnerable module until the kernel is patched
echo "blacklist wm97xx_battery" | sudo tee /etc/modprobe.d/blacklist-wm97xx.conf
sudo update-initramfs -u

# Verify installed kernel version contains the fix
uname -r
apt-cache policy linux-image-$(uname -r) || rpm -q kernel