The act8945a power supply driver in the Linux kernel contains a race condition that results in a use‑after‑free of the power_supply handle. The issue arises because the IRQ is requested with the devm_ variant before the devm_ allocation of the power_supply handle, causing the handle to be freed or unregistered while an interrupt can still fire. When the handler runs, power_supply_changed() is called with a freed or uninitialized struct, which normally causes a system crash or silent memory corruption.

All Linux kernel builds that include the act8945a power supply driver are affected. Since the vulnerability is located in source files that are part of the mainline kernel, any kernel version prior to the patch that loads act8945a is vulnerable. No specific version ranges were provided in the advisory, so all previous releases without the fix are considered at risk.

No CVSS or EPSS score is publicly available and the vulnerability is not listed in CISA's KEV catalog, indicating that exploitation is not widely observed. Attacks would require local control to trigger interrupts or otherwise time the component removal, so the attack vector is likely local and requires the ability to influence the power supply subsystem. If successfully leveraged, the result would be a kernel crash or corruption of memory, effectively denying service to the affected system.