power: supply: ab8500: Fix use-after-free in power_supply_changed() (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.16 % · centile 5 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Analyzed
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Commit 1c1f13a006ed ("power: supply: ab8500: Move to componentized binding") introduced this issue during a refactorization. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle.
Faiblesses (CWE)
- CWE-416 — Utilisation après libération
Références
- https://git.kernel.org/stable/c/43cbb78ee047b9b12d096d40e3be265969d4c1f8
- https://git.kernel.org/stable/c/551672981fe227122258a25a385a05f5c0746ad6
- https://git.kernel.org/stable/c/f50433f2603def08b21a4bf2fd238687fb5cbde9
- https://git.kernel.org/stable/c/847eeb6c0efcd76c7def73857cf798a4fcd8f79b
- https://git.kernel.org/stable/c/709db4b476e254579d9c48ec34d397a41ca0c407
- https://git.kernel.org/stable/c/46dbda27b028d78087667e8280966b99cec015ca
- https://git.kernel.org/stable/c/c4af8a98bb52825a5331ae1d0604c0ea6956ba4b
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-32230
- GCVE · GCVE-0-2026-45946
Avis du CERT-FR
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1093 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0985 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0861 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0831 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.13.4 < 5.15.202cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.165cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.128cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.75cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.14cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.4
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb < 43cbb78ee047b9b12d096d40e3be265969d4c1f8 ; affected 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb < 551672981fe227122258a25a385a05f5c0746ad6 ; affected 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb < f50433f2603def08b21a4bf2fd238687fb5cbde9 ; affected 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb < 847eeb6c0efcd76c7def73857cf798a4fcd8f79b ; affected 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb < 709db4b476e254579d9c48ec34d397a41ca0c407 ; affected 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb < 46dbda27b028d78087667e8280966b99cec015ca |
| Linux · Linux | affected 5.14 ; unaffected 0 < 5.14 ; unaffected 5.15.202 ≤ 5.15.* ; unaffected 6.1.165 ≤ 6.1.* ; unaffected 6.6.128 ≤ 6.6.* ; unaffected 6.12.75 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |