CVE-2026-45882 Linux CVE debrief

Who should care

Linux kernel maintainers, embedded/IoT device manufacturers using Qualcomm PM8916 PMIC, Android device vendors, distribution security teams

Technical summary

The pm8916_bms_vm driver used devm_request_irq() before devm_power_supply_register(), causing reverse-order deallocation during driver removal. This created a race where an interrupt could fire after power_supply handle was freed but before IRQ handler was unregistered, leading to use-after-free in power_supply_changed(). A similar race existed during probe() where interrupts could fire before power_supply registration completed. The fix reorders resource allocation to register power_supply before requesting IRQ.

Defensive priority

high

Recommended defensive actions

• Apply kernel patches from stable branches (5.15.y, 5.10.y, 5.4.y, 4.19.y) via distribution security updates
• Verify pm8916_bms_vm driver is not loaded on affected systems if patching is delayed
• Monitor system logs for kernel oops/panic traces referencing power_supply_changed or pm8916_bms_vm
• Review custom kernel builds for devm_ resource ordering in power supply drivers

Evidence notes

Official CVE record published 2026-05-27. Kernel commit references confirm fix backported to stable branches. No CVSS score assigned by NVD at time of disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.