HIGH Introduced in 3.7
power:supply ChargerManager UAF
CVE-2026-89472
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs charger_manager_remove() and the err_reg_extcon probe error path free each charger regulator with regulator_put() before tearing down the power_supply sysfs entries (power_supply_unregister()). charger_manager_remove() also calls try_charger_enable(cm, false) after the regulator_put() loop. A concurrent write to a charger's externally_control sysfs attribute that lands between regulator_put() and power_supply_unregister() can run charger_externally_control_store() and call try_charger_enable(), which, when charging is enabled, dereferences the already-freed consumer handle. When charging is enabled, try_charger_enable(cm, false) in .remove() also dereferences the freed handles directly. Both leave use-after-free windows. Symmetrically, probe registers the sysfs entries (power_supply_register) before acquiring the regulators (regulator_get, inside charger_manager_register_extcon), so userspace can reach externally_control before the regulators are available. Split charger_manager_register_extcon() on the sync/async boundary: charger_manager_get_regulators() (regulator_get only, no async producer) now runs before power_supply_register() so sysfs is not live before regulators are available, and charger_manager_register_extcon() keeps only the extcon notifier/work setup, still after power_supply_register() so a power_supply_register() failure cannot reach extcon setup. This keeps the sysfs setup/teardown ordering symmetric without introducing an asynchronous producer on the earlier probe-error path. Move power_supply_unregister() and try_charger_enable(cm, false) ahead of the regulator_put() loop on both teardown paths, and adjust err_reg_extcon (power_supply_unregister() then fall through err_regulator for regulator_put(); get_regulators self-rolls back on its own failure). This does not address the separate extcon-notifier-driven deref of the same handles, which needs its own synchronization design. Found by an in-house static analysis tool.
02KernelScan AI Analysis
Risk summary
A local root user on a system with the charger-manager driver loaded can trigger a use-after-free by racing a write to a charger's externally_control sysfs attribute against device removal, or by the direct post-free dereference in the remove path. This can crash the kernel or potentially corrupt kernel heap memory. The vulnerability is limited to systems that use the charger-manager power supply driver, typically battery-powered embedded or mobile platforms.
Vulnerability analysis
The charger-manager driver frees charger regulator handles before tearing down the corresponding sysfs interface entries, creating a window in which a concurrent write to the externally_control attribute can dereference the already-freed handles. The driver also calls a charging-disable routine that uses those same handles after they have been freed during device removal, producing a direct use-after-free regardless of racing. On the probe side, sysfs entries are exposed before the regulators they reference are acquired, so userspace can reach the attribute before the underlying objects exist. The fix reorders both paths so regulators are acquired before sysfs is exposed and freed only after sysfs is removed and charging is disabled, closing both windows. A local user with root privileges who can write to the charger sysfs attributes or trigger platform device removal can reach this vulnerability on systems where the charger-manager driver is loaded.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 3.7 | 7.2.4 | 6d532582ff3c |
| 6.18 | 3.7 | 6.18.50 | 86e4fa65368f |
| 6.12 | 3.7 | 6.12.109 | af3ce383ba0d |
| mainline | 3.7 | 7.3-rc1 | c57cb36f76eb |
| cip/6.12 | 3.7 | 6.12.111-cip32 | af3ce383ba0d |