EUVD-2026-76378
GHSA-24qw-5j5f-29wm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges; AC:L because the remove-path UAF is deterministic (not purely race-dependent), making reliable triggering feasible.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
power: supply: charger-manager: register regulators before exposing sysfs
charger_manager_remove() and the err_reg_extcon probe error path free each charger regulator with regulator_put() before tearing down the power_supply sysfs entries (power_supply_unregister()). charger_manager_remove() also calls try_charger_enable(cm, false) after the regulator_put() loop. A concurrent write to a charger's externally_control sysfs attribute that lands between regulator_put() and power_supply_unregister() can run charger_externally_control_store() and call try_charger_enable(), which, when charging is enabled, dereferences the already-freed consumer handle. When charging is enabled, try_charger_enable(cm, false) in .remove() also dereferences the freed handles directly. Both leave use-after-free windows. Symmetrically, probe registers the sysfs entries (power_supply_register) before acquiring the regulators (regulator_get, inside charger_manager_register_extcon), so userspace can reach externally_control before the regulators are available.
Split charger_manager_register_extcon() on the sync/async boundary: charger_manager_get_regulators() (regulator_get only, no async producer) now runs before power_supply_register() so sysfs is not live before regulators are available, and charger_manager_register_extcon() keeps only the extcon notifier/work setup, still after power_supply_register() so a power_supply_register() failure cannot reach extcon setup. This keeps the sysfs setup/teardown ordering symmetric without introducing an asynchronous producer on the earlier probe-error path.
Move power_supply_unregister() and try_charger_enable(cm, false) ahead of the regulator_put() loop on both teardown paths, and adjust err_reg_extcon (power_supply_unregister() then fall through err_regulator for regulator_put(); get_regulators self-rolls back on its own failure).
This does not address the separate extcon-notifier-driven deref of the same handles, which needs its own synchronization design.
Found by an in-house static analysis tool.
AnalysisAI
Use-after-free in the Linux kernel charger-manager power supply driver exposes local low-privileged users to kernel memory corruption and potential privilege escalation. The driver's probe path registers power_supply sysfs attributes before acquiring regulator handles, and its remove path frees regulator consumer handles before tearing down sysfs - creating two overlapping windows where a write to the externally_control attribute, or the remove path's own try_charger_enable() call, dereferences already-freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local system access with write permission to a charger-manager sysfs externally_control attribute - typically a low-privileged shell user or any process with sysfs write capability; (2) the charger-manager kernel driver (CONFIG_CHARGER_MANAGER) compiled and loaded, which occurs only on embedded, mobile, or ARM Linux systems with dedicated multi-charger battery management hardware - the driver is absent from the overwhelming majority of server and desktop kernel configurations; (3) either a concurrent driver removal event (unbind, rmmod, system shutdown) to trigger the race-window path, or any module removal sequence where charging is currently enabled to trigger the deterministic remove-path UAF. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores this as a high-severity local privilege escalation, reflecting that a low-privileged local user with sysfs write access can trigger the flaw without user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched Linux kernel: 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running vulnerable Linux kernel versions (6.12.x before 109, 6.18.x before 50, or 7.2.x before 4) using system inventory and uname -r scans. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today