CVE-2026-53308: power: supply: max77705: Free allocated workqueue and fix removal order

Published Jun 26, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

power: supply: max77705: Free allocated workqueue and fix removal order

Use devm interface for allocating workqueue to fix two bugs at the same time:

1. Driver leaks the memory on remove(), because the workqueue is not destroyed.

2. Driver allocates workqueue and then registers interrupt handlers with devm interface. This means that probe error paths will not use a reversed order, but first destroy the workqueue and then, via devm release handlers, free the interrupt.

The interrupt handler schedules work on this exact workqueue, thus if interrupt is hit in this short time window - after destroying workqueue, but before devm() frees the interrupt - the schedulled work will lead to use of freed memory.

Change is not equivalent in the workqueue itself: use non-legacy API which does not set (WQLEGACY | WQMEMRECLAIM). The workqueue is used to update power supply (powersupplychanged()) status, thus there is no point to run it for memory reclaim. Note that devname() is not directly used in second argument to prevent possible unlikely parsing any "%" character in device name as format.

Affected Software

2 affected components
Linux Kernel
Linux Linux kernel>=6.15<7.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Allocate the workqueue with the devm interface using a non-legacy API, and ensure the workqueue is destroyed before devm frees the interrupt during removal.

    Linux kernel power-supply max77705 driver workqueue allocation and removal order = Use the devm interface and a non-legacy workqueue API

Event History

Jun 26, 2026
CVE Published
via MITRE·07:41 PM
Data Sourced
via MITRE·07:41 PM
Description
Data Sourced
via NVD·08:17 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-53308?

The severity of CVE-2026-53308 is rated as risk 37.

2

How do I fix CVE-2026-53308?

To fix CVE-2026-53308, use the devm interface for allocating the workqueue in the driver.

3

What systems are affected by CVE-2026-53308?

CVE-2026-53308 affects the Linux kernel, specifically in the power supply for the max77705.

4

What are the consequences of CVE-2026-53308?

CVE-2026-53308 can lead to memory leaks if the workqueue is not properly destroyed upon removal.

5

When was CVE-2026-53308 published?

CVE-2026-53308 was published on June 26, 2026.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203