PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45902 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's BQ256xx power supply driver could allow system crashes or memory corruption during driver removal or probe. The issue stems from incorrect ordering of devm-managed resource allocation: the IRQ was requested before the power_supply handle registration, causing the power_supply to be freed before IRQ unregistration during teardown. This creates a race where an interrupt firing after power_supply deallocation but before IRQ handler removal calls power_supply_changed() with a freed handle. A similar race exists during probe where interrupts could fire before power_supply initialization. The fix reorders resource allocation so IRQ request occurs after power_supply registration, ensuring proper cleanup sequence.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux systems with BQ256xx battery charger hardware, embedded Linux device manufacturers, and kernel maintainers backporting stable fixes

Technical summary

The BQ256xx power supply driver in the Linux kernel used devm_request_irq() before devm_power_supply_register(), violating devm resource ordering guarantees. During driver removal, devm resources free in reverse allocation order, so power_supply_unregister() runs before free_irq(). This window allows pending interrupts to invoke power_supply_changed() with a freed power_supply structure. The vulnerability also affects probe: interrupts can fire before power_supply registration completes, causing uninitialized pointer use. The fix moves devm_request_irq() after devm_power_supply_register(), ensuring the IRQ handler is unregistered before power_supply deallocation during teardown, and that power_supply is valid when interrupts can first fire.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches once available for your distribution
  • Monitor vendor security advisories for backported fixes
  • If running custom kernels with BQ256xx driver, prioritize updating to patched versions
  • Review systems using BQ256xx battery charger ICs for kernel update scheduling

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD entry. Kernel commit references confirm the patch addresses the race condition by reordering devm_power_supply_register() before devm_request_irq().

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45902 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45902

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45902 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45902

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4b6fb0b6124f558131e502e3ffd03e6583b3ace6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/74b5a88318db97d51bb40f774736553c2acd1514

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8005843369723d9c8975b7c4202d1b85d6125302

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/81d3688c9a2158329391e08f2d0b8ba204216044

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/83c27fdd696ac13d023ef7a0345301be93209c53

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8796910131a32ff29275052df768ef022929a394

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cb5c743936edcebc51880eeb6bf04979b5c9438b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.