CVE-2026-45946: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45946 Overview

CVE-2026-45946 is a use-after-free vulnerability in the Linux kernel's ab8500 power supply driver. The flaw resides in the power_supply_changed() code path and was introduced by commit 1c1f13a006ed ("power: supply: ab8500: Move to componentized binding"). The driver requested its interrupt using the devm_ API before allocating and registering the power_supply handle with devm_. Because managed resources are released in reverse allocation order, the power_supply handle is freed before the IRQ handler is unregistered. An interrupt arriving during the small window between those operations triggers a use-after-free that can crash the kernel or silently corrupt memory.

Critical Impact
A race between IRQ teardown and power_supply deallocation can lead to kernel memory corruption or denial of service on affected systems using the ab8500 driver.

Affected Products

Linux kernel versions containing commit 1c1f13a006ed ("power: supply: ab8500: Move to componentized binding")
Systems using the ab8500 power supply driver (ST-Ericsson AB8500 PMIC platforms)
Stable kernel branches prior to the fix commits referenced in kernel.org

Discovery Timeline

2026-05-27 - CVE-2026-45946 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45946

Vulnerability Analysis

The ab8500 power supply driver uses Linux's device-managed (devm_) resource allocation API to simplify cleanup. Resources allocated through devm_ are automatically released in reverse order of allocation when the device is removed. The driver requested its IRQ via devm_request_threaded_irq() before registering the power_supply handle via devm_power_supply_register(). As a result, the power_supply handle is unregistered and freed first during removal, while the IRQ handler remains live.

If an interrupt fires in the window between the power_supply handle being freed and the IRQ being unregistered, the handler calls power_supply_changed() with a dangling pointer. This is a classic use-after-free condition [CWE-416]. A symmetric problem exists during probe(): an interrupt can fire before the power_supply handle is registered, causing the handler to dereference an uninitialized pointer.

Root Cause

The root cause is incorrect ordering of device-managed resource registration. The IRQ must be requested only after every resource it touches is fully initialized, and it must be released before those resources are torn down. Inverting the allocation order through devm_ violates this invariant.

Attack Vector

Exploitation requires triggering driver removal or probe while an interrupt is pending on the AB8500 PMIC. The condition is timing-dependent and typically reachable only locally on hardware that exposes the affected driver. The official fix reorders the calls so that the power_supply handle is registered before the IRQ is requested, ensuring correct teardown order.

No verified exploit code is publicly available. See the kernel commit references for the patch implementation: Kernel fix commit 551672981fe2.

Detection Methods for CVE-2026-45946

Indicators of Compromise

Kernel oops or panic messages referencing power_supply_changed or the ab8500 driver during module unload, suspend/resume, or device probe.
Sporadic kernel memory corruption warnings (KASAN: use-after-free) tied to the power_supply subsystem on AB8500 platforms.
Unexpected reboots or hangs on ST-Ericsson AB8500 hardware following driver reload.

Detection Strategies

Audit running kernel versions against the fixed commits listed on kernel.org to identify unpatched hosts.
Enable CONFIG_KASAN in test builds to surface the use-after-free deterministically during driver probe/remove cycles.
Review dmesg and persistent kernel crash logs for stack traces involving ab8500_charger, ab8500_fg, or ab8500_btemp interrupt handlers.

Monitoring Recommendations

Centralize kernel crash dumps and dmesg output from embedded AB8500 fleets for correlation.
Alert on repeated kernel oops events on the same device class, which indicates a reproducible race rather than transient hardware faults.
Track kernel package versions across embedded inventory to flag hosts running affected stable branches.

How to Mitigate CVE-2026-45946

Immediate Actions Required

Update affected systems to a Linux kernel version that includes the upstream fix commits referenced by kernel.org for CVE-2026-45946.
Identify devices running the ab8500 power supply driver and prioritize them for patching.
Avoid repeated unbind/rebind of the ab8500 driver on unpatched systems to reduce exposure to the race window.

Patch Information

The upstream fix reorders driver initialization so that devm_power_supply_register() runs before devm_request_threaded_irq(), ensuring the IRQ is torn down before the power_supply handle is freed. Backports are available across multiple stable branches. See the official commits:

Workarounds

If patching is not immediately possible, blacklist the ab8500 power supply modules on systems where the functionality is not required.
Restrict the ability of unprivileged users to trigger driver unbind via sysfs by tightening permissions on /sys/bus/.../unbind.
Disable runtime suspend/resume cycles that exercise driver probe/remove paths until the kernel is updated.

bash

# Verify the running kernel and check for the ab8500 driver
uname -r
lsmod | grep ab8500

# Restrict unbind sysfs access (example for the AB8500 platform device)
chmod 600 /sys/bus/platform/drivers/ab8500-charger/unbind