PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45885 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's CPCAP battery driver (cpcap-battery). The issue stems from incorrect ordering of devm-managed resource allocations: the IRQ is requested via devm_request_irq() before the power_supply handle is registered via devm_power_supply_register(). Because devm-managed resources are deallocated in reverse order of allocation, during driver removal the power_supply handle is freed before the IRQ is unregistered. This creates a race window where an interrupt can fire after the power_supply handle has been freed but before the IRQ handler is unregistered, causing the IRQ handler to call power_supply_changed() with a freed pointer. A similar race exists during probe() where an interrupt could fire before the power_supply handle is fully initialized. The fix reorders the code to request the IRQ after power_supply registration, ensuring proper cleanup ordering and eliminating the race condition.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux kernel maintainers, embedded device manufacturers using Motorola CPCAP PMICs, mobile/IoT security teams, and organizations running custom kernel builds on ARM devices with CPCAP battery hardware

Technical summary

The cpcap-battery driver uses devm_request_irq() before devm_power_supply_register(), causing the power_supply handle to be freed before IRQ unregistration during driver removal. This creates a race where power_supply_changed() may be called with a freed pointer. The fix reorders operations to register power_supply before requesting the IRQ.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches once available for your distribution
  • Verify cpcap-battery driver is not loaded on critical systems if patching is delayed
  • Monitor system logs for kernel crashes or memory corruption indicators on affected devices
  • Review custom kernel builds for similar devm resource ordering issues in power supply drivers

Evidence notes

Vulnerability description confirms use-after-free in power_supply_changed() due to devm resource ordering. Multiple stable kernel commits provided indicate backports to affected versions. No CVSS score or severity assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45885 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45885

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45885 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45885

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2841bbb5a35c4449c0a0458e8e476b2a62f95147

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2ce2334be155bd8bad6377e99984246ce4dbd08c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3ff75cba1c98349a23a8f9333981deba1972cc11

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/642f33e34b969eedec334738fd5df95d2dc42742

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c549dd3de4b3f6e726d1b8386d40ccf7d3abdbe4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cbb9b07f88a9ef6518934c41eb3e8cf840d657d5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e261be6f18929f2397cd54cd583a2df624c129c1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.