PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45879 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's BQ25980 power supply driver. The issue stems from incorrect ordering of devm-managed resource allocations: the IRQ is requested via devm_request_irq() before the power_supply handle is registered via devm_power_supply_register(). Because devm-managed resources are deallocated in reverse order of allocation, during driver removal the power_supply handle is freed before the IRQ handler is unregistered. This creates a race window where a pending interrupt can invoke power_supply_changed() with a freed handle, leading to system crashes or memory corruption. A similar race exists during probe() where an interrupt could fire before power_supply registration completes, resulting in use of an uninitialized handle. The fix reorders the code to request the IRQ after power_supply registration, ensuring proper teardown ordering.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with BQ25980 battery charger hardware, embedded Linux device manufacturers, kernel maintainers, and security teams tracking Linux kernel driver vulnerabilities.

Technical summary

The BQ25980 power supply driver in the Linux kernel contains a use-after-free vulnerability caused by incorrect ordering of devm-managed resource allocations. The driver requests an IRQ using devm_request_irq() before registering the power_supply handle with devm_power_supply_register(). Since devm resources are automatically freed in reverse allocation order during driver removal, the power_supply handle is deallocated before the IRQ handler is unregistered. This creates a race condition where a pending interrupt can execute the handler with a freed or uninitialized power_supply pointer, invoking power_supply_changed() on invalid memory. The vulnerability affects both driver removal (use-after-free) and probe paths (use of uninitialized pointer). The resolution reorders the initialization to register power_supply before requesting the IRQ, ensuring proper teardown sequencing.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable trees once available for your distribution
  • Prioritize patching systems using BQ25980 battery charger hardware
  • Monitor vendor security advisories for backported fixes
  • Review custom kernel builds for similar devm resource ordering issues in power supply drivers

Evidence notes

Vulnerability description confirms the use-after-free condition and its root cause in devm resource ordering. Multiple kernel.org stable tree commits provided indicate backports to affected kernel versions. No CVSS score or severity assigned by NVD at time of disclosure.

Official resources

2026-05-27