CVE-2026-45885: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45885 Overview

CVE-2026-45885 is a use-after-free vulnerability in the Linux kernel's cpcap-battery power supply driver. The flaw resides in the driver's probe and removal logic, where the interrupt request (IRQ) is registered via devm_ helpers before the power_supply handle is allocated and registered. Because devm_ resources are released in reverse allocation order, the power_supply handle is freed before the IRQ handler is unregistered. An interrupt firing during this window causes the handler to invoke power_supply_changed() with a freed handle, leading to a kernel crash or silent memory corruption.

Critical Impact
A race between IRQ teardown and power_supply deallocation can crash the kernel or corrupt memory on affected Motorola CPCAP-based platforms.

Affected Products

Linux kernel power: supply: cpcap-battery driver (multiple stable branches)
Motorola CPCAP power management IC platforms (e.g., Droid 4 / OMAP4-based devices)
Downstream distributions shipping vulnerable kernel versions prior to the referenced stable patches

Discovery Timeline

2026-05-27 - CVE-2026-45885 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45885

Vulnerability Analysis

The cpcap-battery driver uses managed device resources (devm_*) for both IRQ registration and power_supply registration. Managed resources are released in reverse allocation order during driver removal. When the IRQ is requested before the power_supply handle is registered, the kernel tears down the power_supply handle first, leaving the IRQ active for a brief window.

During that window, an interrupt can fire and invoke the handler, which then calls power_supply_changed() on a freed handle. This is a classic use-after-free pattern [CWE-416]. The same ordering issue exists in probe(): if the IRQ is registered before the power_supply handle is initialized, an early interrupt would dereference an uninitialized handle.

Root Cause

The root cause is incorrect ordering of devm_ resource allocations. Because devm_ cleanup runs in reverse, the IRQ must be the last managed resource registered so it is the first to be unregistered. The original code violated this invariant by requesting the IRQ before registering power_supply, creating a teardown race and a probe-time uninitialized-use hazard.

Attack Vector

This is a local kernel-side race condition triggered during driver probe or removal. Exploitation would require an attacker with the ability to trigger module unload/reload or induce hardware interrupts on a system running the vulnerable driver. The most likely outcome is denial of service via kernel oops; memory corruption could theoretically be leveraged for privilege escalation, though no public proof of concept exists. The vulnerability is constrained to systems using the Motorola CPCAP battery driver.

The upstream fix reorders initialization so that devm_request_threaded_irq() is called only after devm_power_supply_register() completes successfully. This ensures the IRQ handler is unregistered before the power_supply handle is freed. See the kernel patches referenced below for the exact diff: Kernel Patch 2841bbb5, Kernel Patch c549dd3d, and Kernel Patch f3fbe309.

Detection Methods for CVE-2026-45885

Indicators of Compromise

Kernel oops or panic messages referencing power_supply_changed or cpcap_battery in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free in power_supply_changed() when KASAN-enabled kernels are deployed
Unexplained system instability or reboots on CPCAP-based hardware during driver bind/unbind cycles

Detection Strategies

Verify the running kernel version against the fixed stable trees referenced in the kernel.org patches
Run kernels with KASAN and lockdep enabled in test environments to surface the race deterministically
Audit module load/unload telemetry for repeated probe/remove cycles of cpcap_battery

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on BUG:, KASAN:, and Oops: keywords tied to power supply subsystems
Track kernel package versions across the fleet to confirm patched builds are deployed
Monitor for unauthorized loading of kernel modules on embedded or mobile Linux endpoints

How to Mitigate CVE-2026-45885

Immediate Actions Required

Update affected Linux kernels to a stable release containing the upstream fix for the cpcap-battery ordering issue
Inventory devices running CPCAP-based hardware and prioritize them for patching
Restrict the ability of non-root users to load, unload, or rebind kernel modules

Patch Information

The fix has been merged into multiple stable kernel branches. Apply the patch corresponding to your kernel series: Kernel Patch 2841bbb5, Kernel Patch 2ce2334b, Kernel Patch 3ff75cba, Kernel Patch 642f33e3, Kernel Patch c549dd3d, Kernel Patch cbb9b07f, Kernel Patch e261be6f, and Kernel Patch f3fbe309.

Workarounds

Blacklist the cpcap_battery module on systems that do not require battery telemetry from the CPCAP IC
Avoid runtime unbinding or rebinding of the driver until a patched kernel is installed
Limit physical and administrative access to devices where module manipulation could be triggered

bash

# Blacklist the cpcap_battery module until patched kernel is deployed
echo "blacklist cpcap_battery" | sudo tee /etc/modprobe.d/cve-2026-45885.conf
sudo depmod -a
sudo update-initramfs -u