Skip to main content

Linux Kernel CVE-2026-53308

| EUVDEUVD-2026-39843 MEDIUM
Memory Leak (CWE-401)
2026-06-26 Linux GHSA-2vjf-7vmh-8jpp
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Race condition requires specific interrupt timing during driver teardown, warranting AC:H; no confidentiality or integrity impact applies.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 20:32 vuln.today
CVSS changed
Jul 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

power: supply: max77705: Free allocated workqueue and fix removal order

Use devm interface for allocating workqueue to fix two bugs at the same time:

  1. Driver leaks the memory on remove(), because the workqueue is not

destroyed.

  1. Driver allocates workqueue and then registers interrupt handlers

with devm interface. This means that probe error paths will not use a reversed order, but first destroy the workqueue and then, via devm release handlers, free the interrupt.

The interrupt handler schedules work on this exact workqueue, thus if interrupt is hit in this short time window - after destroying workqueue, but before devm() frees the interrupt - the schedulled work will lead to use of freed memory.

Change is not equivalent in the workqueue itself: use non-legacy API which does not set (__WQ_LEGACY | WQ_MEM_RECLAIM). The workqueue is used to update power supply (power_supply_changed()) status, thus there is no point to run it for memory reclaim. Note that dev_name() is not directly used in second argument to prevent possible unlikely parsing any "%" character in device name as format.

AnalysisAI

Use-after-free and memory leak in the Linux kernel max77705 power supply driver expose systems with Maxim MAX77705 PMIC hardware to local denial-of-service. Two concurrent bugs exist: the workqueue is never destroyed on driver removal (memory leak), and a race condition allows an interrupt handler to schedule work on an already-freed workqueue if the interrupt fires after workqueue destruction but before the devm interface releases the interrupt registration. On vulnerable kernel versions prior to the stable-tree patches (7.0.10 and 7.1 series), a local user on hardware with a MAX77705 PMIC can trigger kernel memory corruption. No public exploit code has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), reflecting negligible opportunistic exploitation interest.

Technical ContextAI

The MAX77705 is a Maxim Integrated (now Analog Devices) PMIC used predominantly in Samsung Galaxy S10/Note 10 series mobile devices running mainline or downstream Linux kernels. The affected driver lives in drivers/power/supply/max77705_charger.c. CWE-401 (Missing Release of Memory after Effective Lifetime) covers the workqueue leak on driver remove(). The deeper issue is a devm ordering bug: the driver allocates the workqueue with the legacy API (alloc_workqueue), then registers interrupt handlers via devm_request_irq. On probe error or removal, devm cleanup runs in reverse registration order - freeing the interrupt before the manually allocated workqueue. The interrupt handler calls schedule_work() on that workqueue, so if an interrupt arrives in the window between workqueue destruction and devm freeing the interrupt, the kernel dereferences freed memory. The fix migrates to devm_alloc_workqueue (non-legacy API, no __WQ_LEGACY | WQ_MEM_RECLAIM flags) to ensure devm handles both teardown in the correct reversed order. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the upstream kernel; affected commit range is identified as commits prior to b98e4e57e34d099a8f846fa54749654082975ea0 and 1e668baadefb16e81269dbfebf3ffc2672e3a3bb in their respective stable branches.

RemediationAI

The primary fix is to upgrade to a patched stable kernel release: Linux 7.0.10 (patch commit b98e4e57e34d099a8f846fa54749654082975ea0, see https://git.kernel.org/stable/c/b98e4e57e34d099a8f846fa54749654082975ea0) or Linux 7.1 (patch commit 1e668baadefb16e81269dbfebf3ffc2672e3a3bb, see https://git.kernel.org/stable/c/1e668baadefb16e81269dbfebf3ffc2672e3a3bb). Distribution maintainers should backport these commits to any supported downstream kernels. If patching is not immediately possible, the practical workaround for affected embedded or mobile platforms is to avoid rapid driver probe/remove cycles (e.g., suppress USB or PMIC hotplug events) to reduce the race window, though this is not a reliable mitigation. Disabling CONFIG_CHARGER_MAX77705 at compile time removes the vulnerable code entirely with the trade-off of losing MAX77705 charging functionality. No vendor advisory URL beyond the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-53308) has been identified in the available references.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53308 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy