CVE-2026-45882: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45882 Overview

CVE-2026-45882 is a use-after-free vulnerability in the Linux kernel's pm8916_bms_vm power supply driver. The flaw exists in the driver's probe and remove paths, where the interrupt request is issued before the power_supply handle registration. Because devm_ managed resources are released in reverse allocation order, the power_supply handle is freed before the IRQ handler is unregistered. An interrupt firing during this window causes power_supply_changed() to operate on a freed handle.

Critical Impact
A race condition between IRQ handling and device unregistration can lead to kernel memory corruption or system crashes through use-after-free access to a freed power_supply handle.

Affected Products

Linux kernel — power: supply: pm8916_bms_vm driver
Stable kernel branches receiving the upstream fix commits
Systems using Qualcomm PM8916 battery monitoring system (BMS) hardware

Discovery Timeline

2026-05-27 - CVE-2026-45882 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45882

Vulnerability Analysis

The vulnerability resides in the pm8916_bms_vm driver, which manages voltage-mode battery monitoring on Qualcomm PM8916 power management ICs. The driver uses the device-managed (devm_) resource framework to allocate the IRQ handler and the power_supply handle. Resource ordering is the root issue.

When the driver calls the devm_ IRQ request before the devm_power_supply registration, the kernel tears down resources in reverse order during device removal. The power_supply handle is freed first, while the IRQ handler remains active. An interrupt arriving in this window invokes power_supply_changed() with a dangling pointer to a deallocated structure.

The same class of bug appears during probe(). An interrupt can fire before the power_supply handle has been registered, leading to use of an uninitialized handle inside power_supply_changed(). Both paths corrupt kernel memory or crash the system [CWE-416].

Root Cause

The root cause is incorrect ordering of devm_-managed resource allocation in the driver's probe routine. The IRQ was requested before the power_supply handle was registered, violating the lifecycle invariant that the IRQ handler must not outlive any data structure it dereferences.

Attack Vector

Triggering the race requires interrupt activity during driver probe or removal. This is typically reachable through device hotplug, module unload, suspend/resume cycles, or hardware-driven battery state changes. Exploitation requires local access to a system running an affected kernel on PM8916 hardware. The vulnerability manifests as a kernel-mode use-after-free that can crash the kernel or corrupt adjacent memory.

No verified public exploit code is available. The fix reorders the driver so that the IRQ request occurs after the power_supply handle registration. See the upstream commits referenced in Kernel Git Commit a8b7117a and Kernel Git Commit b69bb88e.

Detection Methods for CVE-2026-45882

Indicators of Compromise

Kernel oops or panic logs referencing power_supply_changed or pm8916_bms_vm in the call stack
KASAN reports flagging use-after-free reads inside the power_supply subsystem on PM8916 devices
Unexpected reboots or memory corruption coinciding with battery state transitions or module load/unload events

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface use-after-free access patterns in the pm8916_bms_vm driver
Audit kernel versions against the upstream stable commits listed in the NVD references to confirm patch presence
Monitor dmesg for warnings or oops messages referencing the power_supply subsystem during driver bind/unbind events

Monitoring Recommendations

Forward kernel crash dumps and kdump artifacts to a centralized logging pipeline for analysis
Track module load and unload events for pm8916_bms_vm on fleet endpoints running affected kernels
Alert on repeated kernel panics correlated with power management activity on Qualcomm-based hardware

How to Mitigate CVE-2026-45882

Immediate Actions Required

Identify Linux systems running affected kernels on Qualcomm PM8916 hardware, including embedded and mobile platforms
Apply the upstream stable kernel update containing the reordered devm_ resource allocation in pm8916_bms_vm
Reboot affected systems after patching to ensure the corrected driver is loaded

Patch Information

The fix moves the devm_request_irq() call to occur after devm_power_supply_register(), ensuring the IRQ handler is torn down before the power_supply handle is freed. Patches are available in the upstream stable trees via the following commits: 17db6b3a, 62914959, a8b7117a, and b69bb88e.

Workarounds

Blacklist the pm8916_bms_vm module on systems that do not require battery monitoring functionality
Avoid runtime unbind/rebind of the affected driver until the patched kernel is deployed
Restrict local access to affected systems to reduce opportunities for triggering the race during driver lifecycle events

bash

# Blacklist the affected driver until patched kernel is deployed
echo "blacklist pm8916_bms_vm" | sudo tee /etc/modprobe.d/blacklist-pm8916-bms-vm.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep pm8916_bms_vm