CVE-2026-45936: power: supply: goldfish: Fix use-after-free in power_supply_changed()
In the Linux kernel, the following vulnerability has been resolved:
power: supply: goldfish: Fix use-after-free in powersupplychanged()
Using the devm variant for requesting IRQ before the devm variant for allocating/registering the powersupply handle, means that the powersupply handle will be deallocated/unregistered before the interrupt handler (since devm naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just after the powersupply handle has been freed, but just before the corresponding unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling powersupplychanged() with a freed powersupply handle. Which usually crashes the system or otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during probe(); the possibility of an interrupt firing before registering the powersupply handle. This would then lead to the nasty situation of using the powersupply handle uninitialized in powersupplychanged().
Fix this racy use-after-free by making sure the IRQ is requested after the registration of the powersupply handle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the goldfish power-supply driver, request the IRQ only after allocating and registering the power_supply handle, so devm cleanup unregisters the IRQ handler before freeing the power_supply handle.