Skip to main content

Linux Kernel CVE-2026-46270

| EUVDEUVD-2026-34132 HIGH
Use After Free (CWE-416)
2026-06-03 Linux GHSA-vj56-8x44-c882
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 05, 2026 - 07:30 vuln.today
CVSS changed
Jun 05, 2026 - 07:22 NVD
8.4 (HIGH)
Patch available
Jun 03, 2026 - 19:01 EUVD
CVE Published
Jun 03, 2026 - 15:50 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 03, 2026 - 15:50 nvd
HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

power: supply: rt9455: Fix use-after-free in power_supply_changed()

Using the devm_ variant for requesting IRQ _before_ the devm_ variant for allocating/registering the power_supply handle, means that the power_supply handle will be deallocated/unregistered _before_ the interrupt handler (since devm_ naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the power_supply handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run.

This will lead to the IRQ handler calling power_supply_changed() with a freed power_supply handle. Which usually crashes the system or otherwise silently corrupts the memory...

Note that there is a similar situation which can also happen during probe(); the possibility of an interrupt firing _before_ registering the power_supply handle. This would then lead to the nasty situation of using the power_supply handle *uninitialized* in power_supply_changed().

Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the power_supply handle.

AnalysisAI

Use-after-free in the Linux kernel's rt9455 power supply driver allows local attackers to trigger memory corruption or system crashes via a race condition during driver probe or removal. The flaw stems from incorrect ordering of devm_-managed resource allocation, where the IRQ handler can fire against a freed or uninitialized power_supply handle. EPSS is very low (0.02%, 7th percentile) and no public exploit is identified at time of analysis, but the CVSS score of 8.4 reflects high impact on confidentiality, integrity, and availability for systems shipping the rt9455 Richtek battery charger driver.

Technical ContextAI

The bug lives in drivers/power/supply/rt9455.c, which manages the Richtek RT9455 Li-Ion battery charger. Linux's devm_ (device-managed) APIs free resources in reverse allocation order on device unbind. In the buggy code, devm_request_threaded_irq() (or equivalent) was called before devm_power_supply_register(), meaning the power_supply structure is torn down first while the IRQ line remains live for a brief window. An interrupt firing in that window invokes the handler, which calls power_supply_changed() on a dangling pointer - a classic use-after-free (CWE-416). The mirror-image bug also exists at probe time: an early IRQ can dereference an uninitialized power_supply handle. The fix re-orders the two calls so the IRQ is requested only after the power_supply handle is registered.

RemediationAI

Vendor-released patch: upgrade to Linux 7.0 (mainline) or one of the patched stable releases - 6.19.4, 6.18.14, 6.12.75, 6.6.128, 6.1.165, 5.15.202, or 5.10.252 - depending on which long-term branch your distribution tracks; commit references are at https://git.kernel.org/stable/c/d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc and the seven sibling hashes listed in the advisory. Distribution kernels (RHEL, SUSE, Ubuntu, Debian, Android Common Kernel, vendor BSPs for handhelds) should pick up the backport automatically via standard kernel updates. As a compensating control until patched, blacklist the rt9455 module on systems where the RT9455 charger is absent (echo 'blacklist rt9455' to /etc/modprobe.d/), or restrict unprivileged access to driver bind/unbind sysfs nodes (/sys/bus/i2c/drivers/rt9455/{bind,unbind}) - note that blacklisting will disable battery charging management on hardware that genuinely uses the chip, so verify hardware presence first.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-46270 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy