CVE-2026-46270
Use-After-Free in RT9455 Power Supply Driver
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's power supply driver for the rt9455 device. It is a use-after-free bug caused by the order in which resources are allocated and deallocated. Specifically, the interrupt request (IRQ) is requested before the power_supply handle is allocated. Because resource deallocation happens in reverse order, the power_supply handle can be freed before the IRQ handler is unregistered.
This creates a race condition during device removal where an interrupt can trigger after the power_supply handle has been freed but before the IRQ handler is unregistered. As a result, the IRQ handler calls the function power_supply_changed() with a freed (invalid) power_supply handle, which can crash the system or corrupt memory silently.
A similar issue can occur during device probe, where an interrupt fires before the power_supply handle is registered, causing power_supply_changed() to use an uninitialized handle.
The fix involves changing the order so that the IRQ is requested only after the power_supply handle has been registered, preventing the use-after-free condition.
How can this vulnerability impact me? :
This vulnerability can cause system instability or crashes due to the use of a freed power_supply handle in an interrupt handler. It may also lead to silent memory corruption, which can cause unpredictable behavior or data loss.
If exploited or triggered, it could result in denial of service by crashing the Linux kernel or causing erratic system behavior.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the IRQ is requested only after the registration of the power_supply handle. This prevents the race condition where an interrupt can fire after the power_supply handle has been freed but before the IRQ handler is unregistered.
Specifically, update or patch the Linux kernel to include the fix that requests the IRQ after the power_supply handle registration, avoiding use-after-free and uninitialized handle usage in power_supply_changed().