PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45916 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's SBS battery driver (power: supply: sbs-battery) could allow system crashes or memory corruption during driver removal or probe operations. The issue stems from incorrect ordering of devm_ resource allocations: the IRQ was requested before the power_supply handle registration, causing the power_supply to be freed before IRQ unregistration during removal. This creates a race window where an interrupt can fire after the power_supply handle is freed but before the IRQ handler is unregistered, leading to power_supply_changed() being called with a freed pointer. A similar race exists during probe where an interrupt could fire before power_supply registration, resulting in use of an uninitialized handle. The fix reorders the IRQ request to occur after power_supply registration while maintaining the existing behavior of logging warnings on IRQ request failures without failing probe.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with SBS (Smart Battery System) battery hardware, embedded Linux device manufacturers, kernel maintainers, and security teams tracking Linux kernel vulnerabilities affecting power management subsystems.

Technical summary

The sbs-battery driver in the Linux kernel power supply subsystem contains a use-after-free vulnerability due to incorrect devm_ resource allocation ordering. The driver used devm_request_irq() before devm_power_supply_register(), causing reverse-order deallocation during driver removal: power_supply is freed first, then IRQ is unregistered. This creates a race condition where a pending interrupt can execute the IRQ handler with a freed power_supply pointer, calling power_supply_changed() on invalid memory. During probe, a similar race allows interrupts before power_supply registration, causing uninitialized pointer use. The fix moves IRQ request after power_supply registration while preserving warning-only error handling for IRQ failures.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the fix commits once available from your Linux distribution
  • Monitor stable kernel releases for backported fixes to currently supported versions
  • Review systems using SBS (Smart Battery System) battery hardware for exposure
  • Consider disabling SBS battery support if not required and patches are unavailable
  • Monitor NVD for CVSS scoring updates as analysis completes

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD. Multiple stable kernel commits provided indicating backports to various kernel versions. No CVSS score or severity assigned by NVD at time of disclosure; status marked as 'Awaiting Analysis'.

Official resources

2026-05-27