CVE-2026-45916: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45916 Overview

CVE-2026-45916 is a use-after-free vulnerability in the Linux kernel's Smart Battery System (SBS) battery driver located at drivers/power/supply/sbs-battery.c. The flaw stems from an incorrect ordering of device-managed (devm_) resource allocations during driver initialization. The interrupt request handler is registered before the power_supply handle is allocated, causing the power_supply structure to be freed before the IRQ handler is unregistered during driver removal. An interrupt firing during this window invokes power_supply_changed() with a freed handle, leading to memory corruption or a system crash.

Critical Impact

A race condition between IRQ handling and driver removal can trigger a use-after-free in power_supply_changed(), resulting in kernel memory corruption or system crashes on devices using the SBS battery driver.

Affected Products

• Linux kernel versions containing the sbs-battery driver prior to the fix
• Systems using Smart Battery System (SBS) compliant hardware
• Embedded and mobile Linux platforms relying on power_supply subsystem with devm_ IRQ registration

Discovery Timeline

• 2026-05-27 - CVE-2026-45916 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45916

Vulnerability Analysis

The vulnerability resides in the SBS battery driver's probe routine. The driver uses the device-managed resource API (devm_) to request both an interrupt handler and to allocate the power_supply structure. Linux's devm_ framework releases resources in reverse order of allocation. When IRQ registration occurs before power_supply registration, the power_supply handle is torn down first on driver removal, leaving a live IRQ handler that references freed memory.

During the removal window, a hardware interrupt from the battery controller can invoke the registered handler. The handler then calls power_supply_changed() using a pointer to a deallocated power_supply structure. This dereferences freed kernel memory and typically results in a kernel oops, panic, or silent heap corruption.

A secondary condition exists during probe(): an interrupt may fire after IRQ registration but before the power_supply handle is fully initialized, causing power_supply_changed() to operate on uninitialized memory.

Root Cause

The root cause is incorrect lifecycle ordering of managed kernel resources. The devm_ IRQ request is issued before devm_power_supply_register(), violating the invariant that the IRQ handler must not outlive the data it operates on. This is a classic use-after-free pattern triggered by resource teardown ordering.

Attack Vector

Triggering the race requires local hardware-adjacent conditions on systems with an SBS battery device. The race window opens during driver unbind, module removal, or system shutdown when a battery interrupt fires concurrently with the teardown of the power_supply registration. Exploitation primarily manifests as denial of service through kernel crashes, though kernel memory corruption could be leveraged for further impact under specific conditions.

No verified public exploit code is available. Refer to the upstream kernel commits listed in the references for the patch implementation details.

Detection Methods for CVE-2026-45916

Indicators of Compromise

• Unexpected kernel oops or panic messages referencing power_supply_changed, sbs_battery, or power_supply in dmesg or system logs
• KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the power_supply subsystem on kernels built with sanitizer support
• Spontaneous reboots or hangs on devices using SBS-compliant batteries during driver unload or suspend/resume cycles

Detection Strategies

• Audit running kernel versions against the fixed commits referenced in Kernel Git Commit 14d4dee5d8fb and related stable backports
• Inspect kernel crash dumps for stack traces involving power_supply_changed() invoked from an IRQ context after driver removal
• Enable KASAN on test systems to surface the use-after-free deterministically during driver unbind testing

Monitoring Recommendations

• Centralize kernel logs from Linux endpoints and alert on kernel oops, BUG, or KASAN report patterns referencing the power_supply subsystem
• Track kernel package versions across the fleet to confirm patched builds are deployed on systems with battery hardware
• Monitor for repeated unscheduled reboots on laptops, tablets, and embedded devices that may indicate the race is being hit in production

How to Mitigate CVE-2026-45916

Immediate Actions Required

• Apply the upstream Linux kernel patches referenced in the stable tree commits and rebuild affected kernels
• Update to a distribution kernel package that includes the fix once vendors publish backports
• Inventory systems that load the sbs_battery driver and prioritize them for patching

Patch Information

The fix reorders driver initialization so the IRQ is requested after the power_supply handle is registered. This ensures the IRQ handler is torn down before the power_supply structure is freed during driver removal. The patch also preserves graceful behavior by logging a warning and completing probe successfully if the IRQ request fails. Patched commits are available in the upstream stable tree, including 14d4dee5d8fb, 2078830c32d1, 8010b745b436, 82d3eb97a976, 861dda7a9074, 8d59cf3887fb, ca7dd71773e4, and f1f472b14ad5.

Workarounds

• Where the SBS battery driver is not required, blacklist the sbs_battery kernel module to prevent the vulnerable code path from loading
• Avoid runtime unbind or rmmod operations on the sbs_battery driver on production systems pending patch deployment
• Restrict physical and local access to systems with SBS batteries to reduce the likelihood of triggering driver lifecycle events

# Verify whether the sbs-battery driver is loaded and identify kernel version
lsmod | grep sbs_battery
uname -r

# Optional: prevent loading the vulnerable driver until patched
echo "blacklist sbs_battery" | sudo tee /etc/modprobe.d/blacklist-sbs-battery.conf
sudo update-initramfs -u