CVE-2026-53308: Linux Kernel max77705 Memory Leak and Use-After-Free Vulnerability

Technical summary

CVE-2026-53308 addresses two related issues in the max77705 power supply driver within the Linux kernel. First, the driver allocates a work queue via the legacy API but never explicitly destroys it on removal, resulting in memory leaks. Second, the probe sequence creates a resource ordering vulnerability: the workqueue is created, then interrupt handlers are registered using the devm (device-managed) framework. On error or removal, devm handlers execute in reverse registration order, destroying the workqueue before releasing the interrupt handler. If an interrupt is delivered during this window, the interrupt handler will attempt to schedule work on an already-destroyed workqueue, leading to use-after-free memory access. The fix involves converting to the non-legacy workqueue API with explicit devm lifecycle management, ensuring proper teardown ordering and eliminating unnecessary memory reclaim flags.

Business impact

This vulnerability primarily affects systems running the affected Linux kernel versions that utilize the max77705 power supply management IC, commonly found in mobile devices and embedded systems. The memory leak gradually exhausts system resources on long-running devices, while the use-after-free condition can trigger kernel panics or system hangs. For environments managing fleets of embedded Linux devices, this defect increases maintenance burden through unexpected reboots and resource exhaustion incidents. The local-privilege-requirement mitigates enterprise risk, but does not protect single-user or IoT devices where all processes run with equivalent access.

Affected systems

The vulnerability resides in the Linux kernel's max77705 driver subsystem. It affects any Linux distribution shipping a kernel version containing the vulnerable max77705 power supply driver code prior to the fix being merged. Mobile devices, single-board computers, and embedded systems using max77705 ICs for power management are directly impacted. Verify your kernel version and enabled driver configuration against the Linux kernel's git history to determine exposure. Systems without CONFIG_CHARGER_MAX77705 or equivalent enabled are not affected.

Exploitability

Exploitation requires local code execution with non-root user privileges. An attacker must either trigger the interrupt-handling race condition through crafted electrical or logical stimulation of the power supply path, or wait for the memory leak to exhaust available system resources. The race window is narrow and timing-dependent, making reliable exploitation difficult. This is not remotely exploitable and does not grant privilege escalation on its own; it is primarily a stability and resource exhaustion risk rather than a direct security boundary bypass.

Remediation

Apply the upstream Linux kernel patch that converts the max77705 workqueue allocation to the devm-managed non-legacy API. This ensures proper resource lifecycle management and correct teardown ordering. Verify the patch against the official Linux kernel repository to confirm the fix version for your distribution. Distributions should backport the fix to all stable kernel branches in active support.

Patch guidance

Identify your current kernel version using 'uname -r'. Cross-reference against your distribution's kernel changelog and the upstream Linux kernel git repository to confirm the presence of the max77705 fix. Most distributions will deliver the patch through standard kernel updates; check your package manager for available security or maintenance updates. For custom kernels, manually apply the upstream patch from the Linux kernel source tree. After updating, reboot to activate the patched kernel. Verify the fix is applied by confirming the workqueue allocation uses devm management in the driver source code.

Detection guidance

Monitor system logs for kernel warnings or panics related to the max77705 driver or workqueue operations. Use 'dmesg' or systemd journal to search for 'max77705', 'workqueue', or 'use-after-free' patterns. Track memory usage trends on affected systems; sustained memory growth over days or weeks may indicate the leak. Kernel memory leak detection tools (KMEMLEAK, if enabled) will flag the unreleased workqueue allocation. Interrupt storm monitoring can reveal whether abnormal interrupt frequency is triggering the race condition. On live systems, the vulnerability may be silent until resource exhaustion occurs.

Why prioritize this

This medium-severity flaw merits prompt attention for device fleets relying on max77705 power management. While not remotely exploitable and requiring local access, the combination of resource exhaustion and use-after-free creates availability risks that disrupt production deployments. The fix is mature upstream and carries no complexity; the cost of patching is low relative to the cost of managing unplanned device restarts due to memory exhaustion or kernel panics.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects the vulnerability's limited attack surface (local access only, non-root user required), lack of confidentiality or integrity impact, and focus on availability (denial of service through memory exhaustion or kernel crash). The score does not account for increased risk in IoT or single-user embedded environments where attack surface is larger.

Frequently asked questions