CVE-2026-46270

power: supply: rt9455: Fix use-after-free in power_supply_changed()

Published Jun 3, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: rt9455: Fix use-after-free in power_supply_changed()

Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.

This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...

Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.

Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `power_supply` handle.

Analysis

Technical impact

A race condition in the Linux kernel’s power supply driver for RT9455 can cause a use‑after‑free when an interrupt handler is invoked after the power_supply handle has already been freed and before its IRQ is unregistered. This leads to a kernel crash or silent memory corruption, disrupting the entire system. The weakness is a classic use‑after‑free scenario (CWE‑364) and a related improper release of resources violation (CWE‑416).

Affected Systems

The flaw exists in the Linux kernel’s rt9455 power supply module. No specific kernel version ranges are listed, so any kernel build compiling this driver could be impacted.

Risk and Exploitability

The EPSS score is below 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.4 signifies a high severity. Because the flaw requires the driver to be removed while an IRQ is pending, it is reasonable to infer that the attack vector would be local to a privileged user or a process that can trigger driver removal.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< 62d753b916bd500bb269b7078cdab73198ab4718
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< a39f8f06216f73ef40e71e2fe4ad071964c1fd36
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< af261f218a7606f93d2c786353d60bb4feb56ef0
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< 2178dc65d45e2f7bcaa8af8d80d100419bdab251
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< 64e15155095f39f4dec9b4659da1238ef8fc54d4
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< 721449a15170fc5f028a7576d7f65b9f60d53482
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< e2febe375e5ea5afed92f4cd9711bde8f24ee6d2

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`5.10.252`	unaffected	≤ 5.10.*
`5.15.202`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,62d753b916bd500bb269b7078cdab73198ab4718)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,a39f8f06216f73ef40e71e2fe4ad071964c1fd36)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,af261f218a7606f93d2c786353d60bb4feb56ef0)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,2178dc65d45e2f7bcaa8af8d80d100419bdab251)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,64e15155095f39f4dec9b4659da1238ef8fc54d4)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,721449a15170fc5f028a7576d7f65b9f60d53482)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,e2febe375e5ea5afed92f4cd9711bde8f24ee6d2)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[5.10.252,5.11.0)`	unaffected	semver	—
`[5.15.202,5.16.0)`	unaffected	semver	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.14,6.19.0)`	unaffected	semver	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version that implements the fix where the IRQ request is performed after the power_supply registration.
If a kernel upgrade is not immediately possible, disable the rt9455 power‑supply driver or block its IRQ to prevent the use‑after‑free during removal.
Enforce least privilege for any operations that can remove or reload the driver, restricting them to privileged users only.

Generated by OpenCVE AI on June 9, 2026 at 22:24 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.129% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2178dc65d45e2f7bcaa8af8d80d100419bdab251
https://git.kernel.org/stable/c/62d753b916bd500bb269b7078cdab73198ab4718
https://git.kernel.org/stable/c/64e15155095f39f4dec9b4659da1238ef8fc54d4
https://git.kernel.org/stable/c/721449a15170fc5f028a7576d7f65b9f60d53482
https://git.kernel.org/stable/c/a39f8f06216f73ef40e71e2fe4ad071964c1fd36
https://git.kernel.org/stable/c/af261f218a7606f93d2c786353d60bb4feb56ef0
https://git.kernel.org/stable/c/d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc
https://git.kernel.org/stable/c/e2febe375e5ea5afed92f4cd9711bde8f24ee6d2
https://lore.kernel.org/linux-cve-announce/2026060338-CVE-2026-46270-6800@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46270
https://www.cve.org/CVERecord?id=CVE-2026-46270

History

Jun 9, 2026 8:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Jun 5, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Jun 4, 2026 2:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Jun 4, 2026 12:15 AM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026060338-CVE-2026-46270-6800@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46270 https://www.cve.org/CVERecord?id=CVE-2026-46270

Jun 3, 2026 7:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Jun 3, 2026 5:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, but just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle uninitialized in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle.
Title		power: supply: rt9455: Fix use-after-free in power_supply_changed()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2178dc65d45e2f7bcaa8af8d80d100419bdab251 https://git.kernel.org/stable/c/62d753b916bd500bb269b7078cdab73198ab4718 https://git.kernel.org/stable/c/64e15155095f39f4dec9b4659da1238ef8fc54d4 https://git.kernel.org/stable/c/721449a15170fc5f028a7576d7f65b9f60d53482 https://git.kernel.org/stable/c/a39f8f06216f73ef40e71e2fe4ad071964c1fd36 https://git.kernel.org/stable/c/af261f218a7606f93d2c786353d60bb4feb56ef0 https://git.kernel.org/stable/c/d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc https://git.kernel.org/stable/c/e2febe375e5ea5afed92f4cd9711bde8f24ee6d2