CVE-2026-45906: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45906 Overview

CVE-2026-45906 is a use-after-free vulnerability in the Linux kernel's pf1550 power supply driver. The flaw resides in the driver's probe and remove paths, where the interrupt request was performed before the power_supply handle registration using devm_ managed resources. Because devm_ resources deallocate in reverse allocation order, the power_supply handle is freed before the IRQ handler is unregistered. An interrupt firing during this window causes power_supply_changed() to operate on a freed handle, resulting in system crashes or silent memory corruption. A similar race exists during probe, where an interrupt may fire before the handle is initialized.

Critical Impact
An interrupt firing during driver removal or probe can dereference a freed or uninitialized power_supply handle, leading to kernel crashes or memory corruption.

Affected Products

Linux kernel versions containing the pf1550 power supply driver prior to the upstream fix
Stable kernel branches receiving the backported commits 1bdefeed904f and 838767f50747
Embedded systems and NXP-based platforms using the PF1550 PMIC

Discovery Timeline

2026-05-27 - CVE-2026-45906 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45906

Vulnerability Analysis

The pf1550 driver provides power supply support for the NXP PF1550 power management integrated circuit. The driver uses managed device resources (devm_ APIs) to allocate the interrupt handler and the power_supply handle. Managed resources are released automatically when the device is detached, but the order of release is the inverse of allocation.

The driver requested the IRQ before registering the power_supply handle. During removal, the power_supply handle is freed first, while the IRQ remains active. An interrupt arriving in this narrow window invokes power_supply_changed() on a dangling pointer. The same ordering creates a separate race during probe, where the IRQ may fire before the handle is registered, causing access to an uninitialized structure.

Root Cause

The defect is an ordering violation in resource lifetime management. The interrupt handler depends on the power_supply handle, but the handle has a shorter effective lifetime than the IRQ registration. This dependency inversion creates a use-after-free condition [CWE-416] and an uninitialized use condition during probe.

Attack Vector

The vulnerability triggers under normal driver operation when interrupts arrive during module unload or driver probe. Exploitation requires local presence on a system using the affected PMIC. There is no known remote attack vector. The condition can occur during routine power events handled by the PMIC, making it a reliability and stability issue rather than a directly weaponizable flaw.

The vulnerability is described in prose because no verified exploit code is available. The upstream fix reorders driver initialization so the power_supply handle is registered before the IRQ is requested. See the Kernel Git Change Log Entry for the patch contents.

Detection Methods for CVE-2026-45906

Indicators of Compromise

Kernel oops or panic messages referencing power_supply_changed in the call stack on systems using the pf1550 driver
KASAN reports flagging a use-after-free in pf1550 probe or remove paths
Unexpected memory corruption symptoms on embedded systems following PMIC interrupt activity

Detection Strategies

Audit running kernel versions against the fixed commits 1bdefeed904f and 838767f50747 to identify unpatched systems
Enable KASAN on test kernels to surface the race condition during driver bind and unbind cycles
Review dmesg output for kernel warnings tied to the pf1550 driver during module load or removal

Monitoring Recommendations

Aggregate kernel logs from embedded fleets and alert on oops or panic events referencing power supply subsystems
Track patch deployment status across Linux distributions and stable kernel branches
Monitor vendor security advisories for downstream backports of the upstream fix

How to Mitigate CVE-2026-45906

Immediate Actions Required

Apply the upstream kernel patches 1bdefeed904f1f17e1f73a4d8a035515f3a9fad8 and 838767f5074700552d3f006d867caed65edc7328 from the stable tree
Rebuild and deploy kernels on devices using the PF1550 PMIC after confirming the fix is included
Coordinate with hardware vendors and Linux distribution maintainers to obtain validated builds for embedded platforms

Patch Information

The fix reorders driver initialization so the power_supply handle is allocated and registered before devm_request_threaded_irq() is called. This guarantees the IRQ handler is unregistered before the power_supply handle is freed during device teardown. Patch details are available in the Kernel Git Change Log Entry and the companion stable backport.

Workarounds

Avoid binding and unbinding the pf1550 driver at runtime on unpatched kernels
Where feasible, blacklist the pf1550 module on systems that do not require PF1550 PMIC support until patches are applied
Disable hot-unplug scenarios involving the PF1550 device on production hardware pending remediation

bash

# Verify the running kernel contains the fix by checking for the patch commits
git -C /usr/src/linux log --oneline | grep -E '1bdefeed904f|838767f50747'

# Optionally prevent loading on unpatched systems
echo 'blacklist pf1550_charger' | sudo tee /etc/modprobe.d/blacklist-pf1550.conf
sudo update-initramfs -u