PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45906 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's PF1550 power supply driver. The issue stems from incorrect ordering of devm-managed resource allocations: the IRQ is requested via devm_request_irq() before the power_supply handle is registered via devm_power_supply_register(). Because devm resources are deallocated in reverse order of allocation, during driver removal the power_supply handle is freed before the IRQ handler is unregistered. This creates a race window where a pending interrupt can invoke power_supply_changed() with a freed pointer, leading to kernel crashes or memory corruption. A similar race exists during probe() where an interrupt could fire before power_supply registration completes, resulting in use of an uninitialized handle. The fix reorders the code to request the IRQ after power_supply registration, ensuring proper teardown sequencing.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux kernel maintainers, embedded systems developers using NXP PF1550 PMIC, security teams tracking kernel driver vulnerabilities, organizations running Linux on hardware with PF1550 power management IC

Technical summary

The PF1550 power supply driver in the Linux kernel contains a use-after-free vulnerability caused by incorrect ordering of devm-managed resource allocations. The driver calls devm_request_irq() before devm_power_supply_register(), which violates proper teardown ordering since devm resources are freed in LIFO order. During driver removal, this creates a race window between power_supply handle deallocation and IRQ handler unregistration where a pending interrupt can dereference freed memory. The vulnerability also exposes an initialization race during probe() where interrupts may fire before power_supply handle is fully initialized. The fix reorders allocations to register power_supply before requesting IRQ, ensuring that IRQ teardown completes before power_supply deallocation.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches (see ref-4, ref-5)
  • Prioritize patching systems using PF1550 power management IC
  • Monitor for kernel oops/panics in power supply subsystem logs
  • Review other drivers for similar devm resource ordering issues

Evidence notes

Vulnerability description confirms race condition in devm resource ordering. Kernel commit references (ref-4, ref-5) provide patch implementation. No CVSS score assigned; NVD status is 'Awaiting Analysis'.

Official resources

2026-05-27