CVE-2026-45902 Overview
CVE-2026-45902 is a use-after-free vulnerability in the Linux kernel's bq256xx battery charger driver located in drivers/power/supply/. The flaw stems from incorrect ordering of devm_ managed resource allocations during driver probe. The interrupt request occurs before the power_supply handle is registered, causing the handle to be deallocated before the IRQ handler is unregistered during device removal. An interrupt firing during this window invokes power_supply_changed() with a freed power_supply pointer, leading to kernel memory corruption or a system crash [CWE-416].
Critical Impact
A race condition between IRQ handler execution and power_supply deallocation can crash the kernel or silently corrupt memory on systems using the bq256xx charger.
Affected Products
- Linux kernel versions containing the bq256xx power supply driver prior to the fix
- Embedded and mobile Linux systems using Texas Instruments BQ256xx series battery chargers
- Distributions shipping affected stable kernel branches referenced in the upstream commits
Discovery Timeline
- 2026-05-27 - CVE-2026-45902 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45902
Vulnerability Analysis
The bq256xx driver uses device-managed (devm_) allocation helpers to simplify resource cleanup. The kernel deallocates these resources in reverse order of allocation when a device is removed. The driver requested its IRQ using a devm_ helper before registering the power_supply handle with another devm_ helper. This ordering created two distinct race conditions during the driver's lifecycle.
During device removal, the kernel deallocates the power_supply handle first because it was allocated last. The IRQ handler remains registered momentarily afterward. An interrupt arriving in this window causes the handler to call power_supply_changed() with a dangling pointer to freed memory.
A second race exists during probe(). An interrupt can fire after devm_request_irq() succeeds but before the power_supply handle is initialized and registered. The handler then dereferences an uninitialized power_supply structure.
Root Cause
The root cause is incorrect resource ordering in the driver's probe function. The interrupt handler depends on the power_supply handle to function correctly. The handle must therefore exist before the IRQ is enabled and must remain valid until after the IRQ is freed. The original code violated this invariant by requesting the IRQ first.
Attack Vector
Triggering the flaw requires the device to receive a charger interrupt during driver unbind, module unload, or probe. The attack surface is local and depends on physical hardware events from the BQ256xx charger. Remote exploitation is not applicable. Successful triggering results in kernel memory corruption or a denial-of-service crash.
The upstream patches across stable branches (4b6fb0b, 74b5a88, 8005843, 81d3688, 83c27fd, 8796910, cb5c743) reorder the probe sequence so the IRQ is requested only after the power_supply handle is registered. Refer to the Linux Kernel Commit 4b6fb0b for the canonical fix.
Detection Methods for CVE-2026-45902
Indicators of Compromise
- Kernel oops or panic messages referencing power_supply_changed in the call trace on systems using the bq256xx driver
- KASAN reports flagging use-after-free in power_supply_changed() originating from a charger IRQ context
- Unexplained system instability during charger removal, kernel module unload, or driver rebind operations
Detection Strategies
- Inventory Linux systems running kernels with the unpatched bq256xx driver by comparing installed kernel versions against the fix commits
- Enable Kernel Address Sanitizer (KASAN) in test builds to catch the use-after-free condition during stress testing of charger insertion and removal
- Review dmesg output and persistent kernel logs for repeated crashes correlated with battery or charger state transitions
Monitoring Recommendations
- Centralize kernel crash logs and kdump artifacts from embedded fleets for analysis of recurring power_supply faults
- Track kernel version compliance across IoT and mobile device inventories to confirm patch deployment
- Alert on kernel panic frequency increases on hardware platforms known to ship the BQ256xx charger
How to Mitigate CVE-2026-45902
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the commit list to all systems running the bq256xx driver
- Rebuild and redeploy custom kernels for embedded products that include drivers/power/supply/bq256xx.c
- Restrict driver unbind and module unload operations to privileged administrators on production systems until patches are applied
Patch Information
The fix reorders the probe sequence so the power_supply handle is registered before devm_request_irq() is called. This guarantees the handle is valid when the IRQ handler executes and remains valid until after the IRQ is automatically freed by the device-managed teardown. The patch is available in stable kernel commits 4b6fb0b, 74b5a88, 8005843, 81d3688, 83c27fd, 8796910, and cb5c743.
Workarounds
- Blacklist the bq256xx kernel module on systems that do not require charger functionality until a patched kernel is deployed
- Avoid driver unbind, rebind, and module unload operations on affected systems in production environments
- Pin kernel updates to patched stable branches in your distribution's package management configuration to prevent regressions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
