CVE-2026-46270: Linux Kernel RT9455 Power Supply Use-After-Free Vulnerability

Technical summary

CVE-2026-46270 is a use-after-free flaw in drivers/power/supply/rt9455.c related to Linux kernel resource deallocation semantics. The rt9455 driver uses `devm_request_irq()` before `devm_power_supply_register()`. Since devm cleanup runs in reverse allocation order, the power_supply handle is freed before the IRQ handler is unregistered. During driver removal, a race condition allows the interrupt handler to invoke `power_supply_changed()` with a dangling pointer. Additionally, during probe, an interrupt may fire before power_supply registration completes, leading to use of an uninitialized handle. The fix reorders IRQ registration to occur after power supply registration, eliminating the race window. This affects the rt9455 charger/fuel gauge driver specifically.

Business impact

Systems running affected Linux kernel versions with the RT9455 power supply driver (commonly found in ARM-based embedded devices, SBCs, and some laptop/tablet hardware) face kernel-level stability and security risks. Exploitation can cause unexpected system crashes during driver removal or power state transitions, impacting device availability. In devices managing critical power functions (battery management, charging), this instability could lead to data loss or unsafe power-down scenarios. While not remotely exploitable, local attackers or unprivileged users who can trigger driver removal or power supply events may induce denial-of-service conditions.

Affected systems

The vulnerability affects Linux kernel installations with the RT9455 power supply driver. This driver manages battery charging and fuel gauge functionality on devices with Richtek RT9455 or compatible PMICs. Affected platforms typically include ARM-based embedded systems, single-board computers, and certain laptop/tablet models. Desktop and server deployments are unlikely to be affected unless they include legacy RT9455-compatible hardware. The scope is limited to systems where this specific driver is compiled in (rather than modular) or loaded as a module during runtime.

Exploitability

Exploitability is limited to local attack scenarios. An attacker must have the ability to trigger driver removal (e.g., via device unbind) or ensure precise timing of power supply state changes to race the condition. No remote vector exists. Unprivileged users on affected systems may trigger the vulnerability through power management operations (suspend/resume, charger hotplug events). However, the race window is narrow and non-deterministic, making reliable exploitation difficult. The CVSS score of 8.4 reflects the severity of consequences (memory corruption, crash) rather than ease of trigger; actual real-world exploitation requires local access and careful timing.

Remediation

Apply kernel patches that reorder devm resource allocation so that `devm_request_irq()` is called after `devm_power_supply_register()`. This ensures IRQ cleanup precedes power_supply deallocation, eliminating the use-after-free race. Additionally, add NULL-checks or synchronization guards in the interrupt handler to safely handle edge cases during probe/removal sequences. Users should upgrade to patched kernel versions and rebuild/redeploy systems running affected configurations.

Patch guidance

Verify the kernel version running on affected systems against vendor security advisories. Patches are expected in stable kernel releases following the upstream fix merge. Distribution maintainers (Red Hat, Debian, Ubuntu, etc.) will backport patches to their supported kernel branches. For devices using proprietary or vendor-specific kernels, contact the device manufacturer or SoC vendor for updated kernel images. If the rt9455 driver is not used (verify via `lsmod | grep rt9455` or kernel config), no action is required for this specific CVE.

Detection guidance

Monitor system logs for kernel panics, oops messages, or memory corruption errors occurring during power supply driver removal or power state transitions. Look for stack traces mentioning rt9455, power_supply_changed(), or devm cleanup routines. On systems where rt9455 is active, enable kernel debugging (CONFIG_DEBUG_KMEMLEAK, CONFIG_KASAN) in test environments to catch UAF conditions earlier. Runtime inspection: `cat /proc/modules | grep rt9455` confirms if the driver is loaded; cross-reference against vulnerable kernel versions. Kernel address sanitizer (KASAN) builds will reliably flag UAF attempts if configured.

Why prioritize this

Prioritize patching based on deployment criticality and hardware inventory. Systems using RT9455-based chargers (most common on ARM SBCs, ChromeOS devices, and certain Qualcomm Snapdragon platforms) should be updated promptly, particularly if power management or frequent driver load/unload cycles are common. The HIGH CVSS score (8.4) reflects memory corruption impact, though local-only exploitability means it is lower priority than remotely-exploitable flaws. However, kernel stability is foundational; any kernel memory corruption bug merits rapid remediation in production.

Risk score, explained

CVSS 3.1 score of 8.4 (HIGH) reflects: Attack Vector Local (reduces score), Attack Complexity Low (no special conditions needed once triggered), Privileges Required None (unprivileged users can trigger), User Interaction None (automatic via race), Scope Unchanged (confined to single system), and Confidentiality/Integrity/Availability all High (memory corruption impacts all three). The score does not account for the narrow exploitation window; CVSS assumes worst-case conditions. In practice, exploitation difficulty is higher than the numeric score suggests, making this a moderate-to-high practical risk rather than critical.

Frequently asked questions