CVE-2026-45869power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() In `probe()`, `request_irq()` is called before allocating/registering a `power_supply` handle. If an interrupt is fired between the call to `request_irq()` and `power_supply_register()`, the `power_supply` handle will be used uninitialized in `power_supply_changed()` in `wm97xx_bat_update()` (triggered from the interrupt handler). This will lead to a `NULL` pointer dereference since Fix this racy `NULL` pointer dereference by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Since the IRQ is the last thing requests in the `probe()` now, remove the error path for freeing it. Instead add one for unregistering the `power_supply` handle when IRQ request fails.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- May 27, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 7c87942aef52d2120e95ff1dec739998b9f95a78 builds before 3d7b5391bb95505b3581c1fb77150c467ab92864; from 7c87942aef52d2120e95ff1dec739998b9f95a78 before 438f9a303ea8b55162b2d5376490c2ab3ec165a0; from 7c87942aef52d2120e95ff1dec739998b9f95a78 before 9b7d77cb046b4487e8e511e04e62b6f416ce845c; from 7c87942aef52d2120e95ff1dec739998b9f95a78 before 86183153c299e8bb1839e717286d6c6f39508a59; from 7c87942aef52d2120e95ff1dec739998b9f95a78 before 93bdf715d33cf5ee01c58e8546c2469c71ce082a; from 7c87942aef52d2120e95ff1dec739998b9f95a78 before c0def811ad8d642dca9b6d31a198cc39f5f90837; from 7c87942aef52d2120e95ff1dec739998b9f95a78 before dfaf235d5a6b60cbf115a14a656946303ad007b7; from 7c87942aef52d2120e95ff1dec739998b9f95a78 before 39fe0eac6d755ef215026518985fcf8de9360e9e | CNA record |
linux linux_kernel linux:linux_kernel | from 2.6.32 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4 | NVD |
References
- https://git.kernel.org/stable/c/3d7b5391bb95505b3581c1fb77150c467ab92864patch
- https://git.kernel.org/stable/c/438f9a303ea8b55162b2d5376490c2ab3ec165a0patch
- https://git.kernel.org/stable/c/9b7d77cb046b4487e8e511e04e62b6f416ce845cpatch
- https://git.kernel.org/stable/c/86183153c299e8bb1839e717286d6c6f39508a59patch
- https://git.kernel.org/stable/c/93bdf715d33cf5ee01c58e8546c2469c71ce082apatch
- https://git.kernel.org/stable/c/c0def811ad8d642dca9b6d31a198cc39f5f90837patch
- https://git.kernel.org/stable/c/dfaf235d5a6b60cbf115a14a656946303ad007b7patch
- https://git.kernel.org/stable/c/39fe0eac6d755ef215026518985fcf8de9360e9epatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.