CVE-2026-46252

The fix addresses an improper lock usage in the regulator_resolve_supply() error path of the Linux kernel. When enabling a supply regulator fails, the code incorrectly calls _regulator_put() without holding the regulator_list_mutex, triggering a lockdep warning and creating a potential race condition. This flaw could lead to inconsistent regulator state or kernel instability, though the description does not state direct data exposure or arbitrary code execution.

Affected systems are Linux kernel builds that include the regulator subsystem. The vulnerability exists in any kernel revision prior to the commit that implements the correction; specific version ranges are not listed in the advisory.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of active exploitation. The CV score is 5.5, indicating moderate severity. An attacker would need to trigger the error path—potentially through device initialization or configuration changes—making the exposure likely limited to local or privileged users interacting with the kernel.