Use-After-Free Vulnerability in Linux Kernel Power Supply Management

CVE-2026-46270

What is CVE-2026-46270?

A use-after-free vulnerability in the Linux kernel affects power supply management. It arises when the IRQ is requested before the power_supply handle is registered. This leads to a race condition during removal, where an interrupt can trigger after the handle is freed but before the IRQ handler unregistration. When power_supply_changed() is called in this scenario, it operates on a deallocated handle, resulting in system crashes or memory corruption. The fix involves ensuring that IRQ requests follow the registration of the power_supply handle to mitigate the risk.

References