PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45906 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's PF1550 power supply driver. The issue stems from incorrect ordering of devm-managed resource allocations: the IRQ is requested via devm_request_irq() before the power_supply handle is registered via devm_power_supply_register(). Because devm resources are deallocated in reverse order of allocation, during driver removal the power_supply handle is freed before the IRQ handler is unregistered. This creates a race window where a pending interrupt can invoke power_supply_changed() with a freed pointer, leading to kernel crashes or memory corruption. A similar race exists during probe() where an interrupt could fire before power_supply registration completes, resulting in use of an uninitialized handle. The fix reorders the code to request the IRQ after power_supply registration, ensuring proper teardown sequencing.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Linux kernel maintainers, embedded systems developers using NXP PF1550 PMIC, security teams tracking kernel driver vulnerabilities, organizations running Linux on hardware with PF1550 power management IC

Technical summary

The PF1550 power supply driver in the Linux kernel contains a use-after-free vulnerability caused by incorrect ordering of devm-managed resource allocations. The driver calls devm_request_irq() before devm_power_supply_register(), which violates proper teardown ordering since devm resources are freed in LIFO order. During driver removal, this creates a race window between power_supply handle deallocation and IRQ handler unregistration where a pending interrupt can dereference freed memory. The vulnerability also exposes an initialization race during probe() where interrupts may fire before power_supply handle is fully initialized. The fix reorders allocations to register power_supply before requesting IRQ, ensuring that IRQ teardown completes before power_supply deallocation.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches (see ref-4, ref-5)
  • Prioritize patching systems using PF1550 power management IC
  • Monitor for kernel oops/panics in power supply subsystem logs
  • Review other drivers for similar devm resource ordering issues

Evidence notes

Vulnerability description confirms race condition in devm resource ordering. Kernel commit references (ref-4, ref-5) provide patch implementation. No CVSS score assigned; NVD status is 'Awaiting Analysis'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45906 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45906

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45906 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45906

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1bdefeed904f1f17e1f73a4d8a035515f3a9fad8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/838767f5074700552d3f006d867caed65edc7328

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.