The act8945a power supply driver in the Linux kernel contains a race condition that results in a use‑after‑free of the power_supply handle. The issue arises because the IRQ is requested with the devm_ variant before the devm_ allocation of the power_supply handle, causing the handle to be freed or unregistered while an interrupt can still fire. When the handler runs, power_supply_changed() is called with a freed or uninitialized struct, which normally causes a system crash or silent memory corruption.

All Linux kernel builds that include the act8945a power supply driver are affected. Since the vulnerability is located in source files that are part of the mainline kernel, any kernel version prior to the patch that loads act8945a is vulnerable. No specific version ranges were provided in the advisory, so all previous releases without the fix are considered at risk.

The EPSS score for this vulnerability is reported as < 1%, indicating a very low but nonzero probability of exploitation; it is not listed in CISA's KEV catalog. This use‑after‑free flaw, classified as CWE‑364, could allow a locally privileged attacker to trigger an interrupt during device removal or probe, leading to a kernel crash or silent memory corruption. The attack vector is likely local and requires influence over the power supply subsystem to cause the interrupt at the precise race condition.