CVE-2026-19809: Kernel stack information disclosure in the charger_get_prop() system call handler

The user-mode system call verifier zvrfychargergetprop() in drivers/charger/chargerhandlers.c declares an uninitialized union chargerpropval kval on the kernel (privileged) stack, passes it to the charger driver back end via zimplchargergetprop(), and then copies the full sizeof(union chargerpropval) back into the calling user thread's buffer with kusermodetocopy(). That discloses kernel stack contents on two paths:

On error. The copy-out ignores the driver's return code. In-tree back ends return an error without writing through the value pointer for properties they do not implement: chargergpiogetprop() returns -ENOTSUP unconditionally, and bq24190getprop() has a default: return -ENOTSUP; arm that never touches val. The whole union is then stack residue. On success. A back end writes only the one union member the requested property selects (for example sbscharger.c writes the one-byte val->present for CHARGERPROPPRESENT and returns 0), yet the handler still copies the whole union, so every byte beyond that member is uninitialized.

The handler is compiled only when CONFIGUSERSPACE=y and is reachable by any user-mode thread that has been granted access to a charger device object. KSYSCALLDRIVERCHARGER() validates only the device object and its API pointer, not the property identifier, so an unprivileged thread can choose prop freely: an unimplemented property forces the error path, a narrow one the success path, and the call can be repeated at will.

Each call discloses up to the size of the union (12 bytes on a 32-bit target, 16 bytes on 64-bit targets where the function-pointer members widen it) of supervisor-stack memory. The bytes are residue of earlier kernel-side frames on the thread's privileged stack and can contain kernel object addresses and saved return addresses, which an unprivileged thread cannot otherwise observe and which help defeat address-layout assumptions when exploiting a separate memory-safety defect. There is no integrity or availability impact.

Two commits fix it, and both are needed. 5054384e983c skips the copy-out when the back end reports an error. c31cac727d02 zeroes the union before the driver call, so the bytes copied out on success are driver-written data or zeros. A tree carrying only the first still leaks on every successful call.