CVE-2026-53308 Overview
CVE-2026-53308 is a use-after-free vulnerability in the Linux kernel max77705 power supply driver. The flaw stems from incorrect ordering of resource cleanup during driver removal and probe error paths. The driver allocates a workqueue manually but registers interrupt handlers via the devm managed interface. This mismatch causes the workqueue to be destroyed before the interrupt handler is freed. An interrupt firing in this window schedules work on freed memory, leading to memory corruption. The driver also leaks the workqueue memory on removal because it is never destroyed.
Critical Impact
An interrupt firing after workqueue destruction but before interrupt handler release schedules work on freed memory, causing use-after-free conditions in kernel space.
Affected Products
- Linux kernel builds containing the max77705 power supply driver
- Devices using the Maxim MAX77705 power management integrated circuit
- Distributions shipping affected upstream kernel versions prior to the fix
Discovery Timeline
- 2026-06-26 - CVE-2026-53308 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-53308
Vulnerability Analysis
The max77705 power supply driver manages battery and charging state for devices using the Maxim MAX77705 PMIC. The driver allocates a workqueue used to propagate power supply state changes through power_supply_changed(). Interrupt handlers registered later schedule work items onto this queue when hardware events occur.
The bug arises from inconsistent resource management. The workqueue is allocated with the plain (non-devm) API, while interrupts are registered with devm_request_irq() or an equivalent managed call. During removal or probe failure, the kernel releases resources in reverse allocation order. Managed resources are released after the explicit destroy_workqueue() call runs. This creates a window where the interrupt handler is still armed but the target workqueue has been freed. An interrupt in this window causes a use-after-free when the handler attempts to schedule work.
A secondary defect exists: the manually allocated workqueue was never freed on remove, producing a kernel memory leak on driver unload.
Root Cause
The root cause is a mismatch between manual and devm managed resource allocation. Mixing the two allocation styles produces a non-reversible teardown order. The fix converts workqueue allocation to devm_alloc_workqueue(), ensuring both cleanup ordering and automatic release. The fix also drops the __WQ_LEGACY | WQ_MEM_RECLAIM flags because the workqueue only updates power supply status and does not participate in memory reclaim.
Attack Vector
Exploitation requires local access to trigger driver removal or probe failure while power management interrupts remain active. An attacker with sufficient privilege to unbind the driver or induce probe errors can race an interrupt against the cleanup window. Successful exploitation corrupts kernel memory and can cause denial of service or, under favorable heap conditions, escalation of privilege. Refer to the upstream commit 1e668baadefb and commit b98e4e57e34d for the exact code changes.
Detection Methods for CVE-2026-53308
Indicators of Compromise
- Kernel oops or panic messages referencing max77705, queue_work, or power_supply_changed in dmesg output
- KASAN use-after-free reports pointing to max77705 module frames
- Unexplained kernel memory growth on systems that repeatedly bind and unbind the max77705 driver
Detection Strategies
- Audit installed kernel versions across mobile and embedded fleets to identify unpatched max77705 builds
- Enable KASAN in test builds to surface use-after-free conditions in the power supply subsystem
- Correlate kernel crash telemetry with driver bind and unbind events using centralized log analysis
Monitoring Recommendations
- Forward dmesg and kernel.log to a centralized data lake for kernel crash pattern analysis
- Alert on repeated kernel oops events referencing power supply drivers on the same host
- Track driver load and unload events via udev or systemd journal collection
How to Mitigate CVE-2026-53308
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits 1e668baadefb and b98e4e57e34d
- Update to a distribution kernel that includes the max77705 cleanup ordering fix
- Restrict local privileged access that could trigger driver unbind operations on affected hosts
Patch Information
The fix converts the workqueue allocation to use devm_alloc_workqueue(), aligning it with the devm-registered interrupts so all resources release in reverse order. The patch also removes the WQ_MEM_RECLAIM flag as unnecessary for power supply status updates. See kernel.org commit 1e668baadefb and kernel.org commit b98e4e57e34d.
Workarounds
- Avoid unbinding or reloading the max77705 driver at runtime on unpatched systems
- Restrict CAP_SYS_MODULE and access to /sys/bus/*/drivers/max77705/unbind to trusted administrators
- Disable the max77705 driver in kernel configuration where the PMIC is not physically present
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
