CVE-2026-46270
power: supply: rt9455: Fix use-after-free in power_supply_changed()
Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle.
INFO
Published Date :
June 3, 2026, 6:16 p.m.
Last Modified :
July 22, 2026, 8:10 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Request IRQ after power supply handle registration.
- Ensure correct resource deallocation order.
- Update kernel to include the fix.
- Test the remediation thoroughly.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46270.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46270 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46270
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46270 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46270 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 22, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: power: supply: rt9455: Corrección de uso después de liberación en power_supply_changed() Usar la variante 'devm_' para solicitar IRQ _antes_ de la variante 'devm_' para asignar/registrar el manejador 'power_supply', significa que el manejador 'power_supply' será desasignado/dado de baja _antes_ del gestor de interrupciones (ya que 'devm_' desasigna naturalmente en orden inverso de asignación). Esto significa que durante la eliminación, existe una condición de carrera donde una interrupción puede dispararse justo _después_ de que el manejador 'power_supply' haya sido liberado, pero justo _antes_ de que se haya ejecutado la baja correspondiente del gestor de IRQ. Esto llevará a que el gestor de IRQ llame a 'power_supply_changed()' con un manejador 'power_supply' liberado. Lo que usualmente bloquea el sistema o de otra manera corrompe silenciosamente la memoria... Tenga en cuenta que existe una situación similar que también puede ocurrir durante 'probe()'; la posibilidad de que una interrupción se dispare _antes_ de registrar el manejador 'power_supply'. Esto entonces llevaría a la desagradable situación de usar el manejador 'power_supply' sin inicializar en 'power_supply_changed()'. Corrija este uso después de liberación con condición de carrera asegurándose de que la IRQ sea solicitada _después_ del registro del manejador 'power_supply'. -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e86d69dd786e94046b8f5be7df1b9a8226a40b2a', 'lessThan': 'd4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc', 'versionType': 'git'}, {'status': 'affected', 'version': 'e86d69dd786e94046b8f5be7df1b9a8226a40b2a', 'lessThan': '62d753b916bd500bb269b7078cdab73198ab4718', 'versionType': 'git'}, {'status': 'affected', 'version': 'e86d69dd786e94046b8f5be7df1b9a8226a40b2a', 'lessThan': 'a39f8f06216f73ef40e71e2fe4ad071964c1fd36', 'versionType': 'git'}, {'status': 'affected', 'version': 'e86d69dd786e94046b8f5be7df1b9a8226a40b2a', 'lessThan': 'af261f218a7606f93d2c786353d60bb4feb56ef0', 'versionType': 'git'}, {'status': 'affected', 'version': 'e86d69dd786e94046b8f5be7df1b9a8226a40b2a', 'lessThan': '2178dc65d45e2f7bcaa8af8d80d100419bdab251', 'versionType': 'git'}, {'status': 'affected', 'version': 'e86d69dd786e94046b8f5be7df1b9a8226a40b2a', 'lessThan': '64e15155095f39f4dec9b4659da1238ef8fc54d4', 'versionType': 'git'}, {'status': 'affected', 'version': 'e86d69dd786e94046b8f5be7df1b9a8226a40b2a', 'lessThan': '721449a15170fc5f028a7576d7f65b9f60d53482', 'versionType': 'git'}, {'status': 'affected', 'version': 'e86d69dd786e94046b8f5be7df1b9a8226a40b2a', 'lessThan': 'e2febe375e5ea5afed92f4cd9711bde8f24ee6d2', 'versionType': 'git'}], 'programFiles': ['drivers/power/supply/rt9455_charger.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.252', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.202', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.165', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.128', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.75', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.14', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '6.19.4', 'versionType': 'semver', 'lessThanOrEqual': '6.19.*'}, {'status': 'unaffected', 'version': '7.0', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/power/supply/rt9455_charger.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jun. 09, 2026
Action Type Old Value New Value Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.14 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.4 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.128 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.75 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.202 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.165 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.2 up to (excluding) 5.10.252 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2178dc65d45e2f7bcaa8af8d80d100419bdab251 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/62d753b916bd500bb269b7078cdab73198ab4718 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/64e15155095f39f4dec9b4659da1238ef8fc54d4 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/721449a15170fc5f028a7576d7f65b9f60d53482 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a39f8f06216f73ef40e71e2fe4ad071964c1fd36 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/af261f218a7606f93d2c786353d60bb4feb56ef0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e2febe375e5ea5afed92f4cd9711bde8f24ee6d2 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 05, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 03, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Added Reference https://git.kernel.org/stable/c/2178dc65d45e2f7bcaa8af8d80d100419bdab251 Added Reference https://git.kernel.org/stable/c/62d753b916bd500bb269b7078cdab73198ab4718 Added Reference https://git.kernel.org/stable/c/64e15155095f39f4dec9b4659da1238ef8fc54d4 Added Reference https://git.kernel.org/stable/c/721449a15170fc5f028a7576d7f65b9f60d53482 Added Reference https://git.kernel.org/stable/c/a39f8f06216f73ef40e71e2fe4ad071964c1fd36 Added Reference https://git.kernel.org/stable/c/af261f218a7606f93d2c786353d60bb4feb56ef0 Added Reference https://git.kernel.org/stable/c/d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc Added Reference https://git.kernel.org/stable/c/e2febe375e5ea5afed92f4cd9711bde8f24ee6d2