CVE-2026-45867

What it actually does

This is a Linux kernel use-after-free race condition in the ACT8945A power supply driver. The driver requests an interrupt using device-managed cleanup before registering the power_supply object, which causes teardown to occur in the wrong order. During device removal, an interrupt can fire after the power_supply structure has already been freed but before the IRQ handler is unregistered. The interrupt handler can then call power_supply_changed() with a stale pointer, potentially causing a kernel crash, memory corruption, or, in a successful exploitation scenario, local privilege escalation or kernel-level code execution. A related probe-time race can also cause use of an uninitialized power_supply handle if an interrupt fires before registration completes.

Why it matters to the business

Systems running affected Linux kernels with the vulnerable ACT8945A power supply driver enabled may be exposed to local denial of service or, in higher-impact scenarios, compromise of the operating system kernel. The practical exposure is likely limited to systems that include or load this specific power-management hardware driver, such as certain embedded, appliance, IoT, or specialized Linux platforms. Although the EPSS score is low, the CVSS impact is high because kernel memory corruption can affect confidentiality, integrity, and availability if an attacker already has local access.

How an attack unfolds

An attacker first needs local access to a system running an affected Linux kernel where the ACT8945A power supply driver is present and active. The attacker then attempts to trigger driver probe or removal paths while causing or racing an interrupt from the power supply device. If the interrupt occurs in the vulnerable timing window, the IRQ handler may reference a power_supply object that has already been freed or not yet initialized. In the most common failure mode, this results in a kernel oops, panic, or system instability. A more advanced attacker may attempt to shape heap state and interrupt timing so the stale pointer references attacker-influenced memory, potentially enabling privilege escalation or arbitrary kernel memory corruption. No public exploit maturity is currently identified, and the vulnerability is not listed in CISA KEV.

How to fix it

Upgrade to a Linux kernel build that includes the upstream fix for the ACT8945A power supply driver, which requests the IRQ only after the power_supply handle has been registered so teardown occurs safely. If fixed package versions are not provided by the distribution, use the latest stable kernel from the operating system or device vendor that references this CVE or the act8945a power_supply_changed() use-after-free fix. For systems where immediate patching is not possible, reduce exposure by disabling or not loading the act8945a driver where it is not required, preventing untrusted users from loading or unloading kernel modules, restricting local shell access, and applying kernel hardening features such as module signing, lockdown mode, KASLR, hardened slab allocators, and panic-on-oops policies appropriate to the environment. Embedded and appliance vendors should backport the driver-ordering fix into maintained kernel branches used in firmware images.

How to confirm the fix worked

Confirm the running kernel version or vendor package changelog includes the fix for the ACT8945A power supply driver use-after-free in power_supply_changed(). On source-based or embedded builds, inspect the driver implementation and verify that power_supply registration occurs before IRQ request and that device-managed cleanup order cannot unregister the power_supply object before the IRQ handler is removed. Confirm whether the vulnerable driver is present or active by checking kernel configuration, loaded modules, device tree overlays, and boot logs for ACT8945A references. After patching, reboot into the fixed kernel and verify with uname, package manager metadata, or vendor firmware version output. Where safe and appropriate in a lab, exercise module load/unload, device probe/remove, and suspend/resume paths while monitoring dmesg for KASAN, use-after-free, power_supply_changed(), IRQ, or kernel oops messages.

Typical attack path

1. Gain local access to an affected Linux system with the ACT8945A power supply driver enabled or loadable.
2. Confirm the vulnerable driver and hardware path are present, such as by checking loaded modules, device tree entries, or kernel logs referencing act8945a.
3. Trigger driver probe, device removal, module unload, suspend/resume, or another lifecycle path that exercises driver registration or cleanup.
4. Race the lifecycle operation with an interrupt from the ACT8945A power supply device.
5. Cause the interrupt handler to call power_supply_changed() using a freed or uninitialized power_supply handle.
6. Achieve a kernel crash, memory corruption, or potentially local privilege escalation if kernel memory layout and race timing can be controlled.

How to detect it

Detection should focus on evidence of attempted driver lifecycle races, kernel memory corruption, or crashes involving the ACT8945A power supply driver. Review kernel logs from dmesg, journald, syslog, crash dumps, pstore/ramoops, and centralized logging for messages referencing act8945a, power_supply_changed(), use-after-free, KASAN, slab corruption, IRQ handler faults, kernel oops, or panic events. Correlate these with local user activity such as module load/unload commands, device unbind/rebind operations under sysfs, suspend/resume activity, or administrative scripts interacting with power-supply devices. On systems with auditd or EDR telemetry, look for invocations of modprobe, rmmod, insmod, kmod, tee, sh, or echo writing to /sys/bus/*/drivers/*/unbind, /sys/bus/*/drivers/*/bind, or power-management sysfs paths around the time of kernel faults. Because this is a local kernel race and no public exploit indicators are known, absence of a specific IOC does not rule out exploitation; kernel crash artifacts and suspicious local manipulation of driver state are the most useful signals.

• act8945a
• CONFIG_CHARGER_ACT8945A
• power_supply_changed
• use-after-free
• KASAN: use-after-free
• BUG: KASAN
• kernel BUG
• Oops:
• general protection fault
• Unable to handle kernel NULL pointer dereference
• slab-use-after-free
• IRQ handler
• /sys/class/power_supply
• /sys/bus/platform/drivers
• /sys/bus/i2c/drivers
• /sys/kernel/debug/devices_deferred
• /proc/config.gz
• /boot/config-
• modprobe act8945a
• rmmod act8945a
• insmod act8945a

What your security team should do

• Prioritize patching Linux systems, embedded devices, and appliances that use the ACT8945A power supply driver or vendor kernels derived from affected Linux versions.
• Inventory exposure by searching kernel configs, module lists, firmware manifests, and boot logs for act8945a, CONFIG_CHARGER_ACT8945A, or related ACT8945A device tree entries.
• If the driver is not required, disable it in the kernel configuration, blacklist the module if modularized, or remove the relevant device tree binding from custom firmware builds.
• Restrict local access and administrative capabilities that allow users to load/unload modules, trigger device reprobe, or manipulate power-management device state.
• Monitor kernel logs for crashes, KASAN reports, use-after-free warnings, and oops traces involving act8945a, power_supply_changed(), or IRQ handlers.
• For products or appliances, coordinate with the device vendor for firmware containing the backported kernel fix and plan maintenance windows for reboot-required updates.