PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45916 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's SBS battery driver (power: supply: sbs-battery) could allow system crashes or memory corruption during driver removal or probe operations. The issue stems from incorrect ordering of devm_ resource allocations: the IRQ was requested before the power_supply handle registration, causing the power_supply to be freed before IRQ unregistration during removal. This creates a race window where an interrupt can fire after the power_supply handle is freed but before the IRQ handler is unregistered, leading to power_supply_changed() being called with a freed pointer. A similar race exists during probe where an interrupt could fire before power_supply registration, resulting in use of an uninitialized handle. The fix reorders the IRQ request to occur after power_supply registration while maintaining the existing behavior of logging warnings on IRQ request failures without failing probe.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux systems with SBS (Smart Battery System) battery hardware, embedded Linux device manufacturers, kernel maintainers, and security teams tracking Linux kernel vulnerabilities affecting power management subsystems.

Technical summary

The sbs-battery driver in the Linux kernel power supply subsystem contains a use-after-free vulnerability due to incorrect devm_ resource allocation ordering. The driver used devm_request_irq() before devm_power_supply_register(), causing reverse-order deallocation during driver removal: power_supply is freed first, then IRQ is unregistered. This creates a race condition where a pending interrupt can execute the IRQ handler with a freed power_supply pointer, calling power_supply_changed() on invalid memory. During probe, a similar race allows interrupts before power_supply registration, causing uninitialized pointer use. The fix moves IRQ request after power_supply registration while preserving warning-only error handling for IRQ failures.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the fix commits once available from your Linux distribution
  • Monitor stable kernel releases for backported fixes to currently supported versions
  • Review systems using SBS (Smart Battery System) battery hardware for exposure
  • Consider disabling SBS battery support if not required and patches are unavailable
  • Monitor NVD for CVSS scoring updates as analysis completes

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD. Multiple stable kernel commits provided indicating backports to various kernel versions. No CVSS score or severity assigned by NVD at time of disclosure; status marked as 'Awaiting Analysis'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45916 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45916

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45916 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45916

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/14d4dee5d8fb361bfff275832087254beab66d72

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2078830c32d1e49ac942c6f8c21f35c806ae5e94

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8010b745b436c3e1ca5dd960aa29fa3e0f6d8841

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/82d3eb97a976c9d56bb92b241397610e57a9c629

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/861dda7a9074c0ff67788928165ae39d7f647491

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8d59cf3887fbabacef53bfba473e33e8a8d9d07b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ca7dd71773e4e050b0fb98768b7eae60f8d1f38b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.