CVE-2026-45902: power: supply: bq256xx: Fix use-after-free in power_supply_changed()
In the Linux kernel, the following vulnerability has been resolved:
power: supply: bq256xx: Fix use-after-free in powersupplychanged()
Using the devm variant for requesting IRQ before the devm variant for allocating/registering the powersupply handle, means that the powersupply handle will be deallocated/unregistered before the interrupt handler (since devm naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just after the powersupply handle has been freed, but just before the corresponding unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling powersupplychanged() with a freed powersupply handle. Which usually crashes the system or otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during probe(); the possibility of an interrupt firing before registering the powersupply handle. This would then lead to the nasty situation of using the powersupply handle uninitialized in powersupplychanged().
Fix this racy use-after-free by making sure the IRQ is requested after the registration of the powersupply handle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In probe(), ensure the IRQ is requested after the power_supply handle is allocated/registered (i.e., perform the devm_ allocation/registration of the power_supply handle before using the devm_ variant to request the IRQ) so that deallocation/unregistration order prevents the IRQ handler from running with a freed power_supply handle.
power: supply: bq256xx IRQ request order / power_supply registration order = Register the power_supply handle before requesting the IRQ; use the devm_ variant for allocating/registering the power_supply handle before the devm_ variant for requesting the IRQ
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel bq256xx power_supply driver are affected. The vulnerable paths involve driver probe and device removal while its interrupt handler can run.
What conditions are required to trigger the vulnerability?
An interrupt must fire during a narrow race window: either before the power_supply handle is registered during probe, or after it has been freed during device removal but before the IRQ handler is unregistered. Exploitation requires local access with low privileges according to the CVSS vector.
What is the likely impact if the race occurs?
The IRQ handler can call power_supply_changed() with an uninitialized or freed power_supply handle. This can crash the system or silently corrupt memory, with high confidentiality, integrity, and availability impact in the supplied CVSS assessment.
How is the issue addressed?
The fix requests the IRQ only after allocating and registering the power_supply handle, preventing interrupts from using an uninitialized handle during probe and ensuring IRQ teardown occurs before the handle is released during removal.