EUVD-2026-76375
GHSA-69w5-534x-wxxj
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Race condition exploitation requires timing precision (AC:H) and ability to trigger device removal implying at minimum local user or physical access (PR:L), not unauthenticated.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg->work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it.
Free the IRQ first so the threaded handler is quiesced and can no longer queue work, then cancel the delayed work to drain the final generation.
This issue was found by an in-house static analysis tool.
AnalysisAI
Use-after-free in the Linux kernel's LP8727 battery charger driver allows local exploitation via a race condition in lp8727_release_irq() that can corrupt kernel memory. The defect exists because lp8727_release_irq() cancelled the delayed work before freeing the IRQ, leaving a window where a concurrently delivered IRQ could cause the threaded handler lp8727_isr_func() to re-arm the work via schedule_delayed_work(); after the .remove path returned and the devm layer freed pchg, lp8727_delayed_func() could still execute and dereference the freed structure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target system must have the LP8727 charger IC physically present and the lp8727_charger kernel module loaded; (2) the attacker must be able to trigger driver removal, either via physical device disconnect or by having privileges to run modprobe -r lp8727_charger or equivalent; (3) the race condition between an IRQ delivery and the .remove teardown sequence must be won, requiring concurrent IRQ activity from the charger IC during removal. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is substantially lower than the supplied CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel: 6.12.109 or later for the 6.12 stable series, 6.18.50 or later for the 6.18 series, or 7.2.4 or later for the 7.2 series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory Linux systems running the LP8727 charger driver by checking kernel logs and module lists, then assess local-user access exposure on affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today