CVE-2026-45869

power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()

MEDIUM
5.5
CVSS Score
Published: May 27, 2026 at 12:15 PM UTC
Updated: June 27, 2026 at 11:41 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() In `probe()`, `request_irq()` is called before allocating/registering a `power_supply` handle. If an interrupt is fired between the call to `request_irq()` and `power_supply_register()`, the `power_supply` handle will be used uninitialized in `power_supply_changed()` in `wm97xx_bat_update()` (triggered from the interrupt handler). This will lead to a `NULL` pointer dereference since Fix this racy `NULL` pointer dereference by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Since the IRQ is the last thing requests in the `probe()` now, remove the error path for freeing it. Instead add one for unregistering the `power_supply` handle when IRQ request fails.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.32 ≤ v < 5.10.2522.6.32 ≤ v < 5.15.2022.6.32 ≤ v < 6.1.1652.6.32 ≤ v < 6.12.752.6.32 ≤ v < 6.18.142.6.32 ≤ v < 6.19.42.6.32 ≤ v < 6.6.1282.6.32 ≤ v < 7.05.11 ≤ v < 5.15.2025.16 ≤ v < 6.1.1656.13 ≤ v < 6.18.146.19 ≤ v < 6.19.46.2 ≤ v < 6.6.1286.7 ≤ v < 6.12.752.6.327c87942aef52d2120e95ff1dec739998b9f95a78
Vendor states this is fixed in 39fe0eac6d755ef215026518985fcf8de9360e9e (fixed)
Vendor states this is fixed in 3d7b5391bb95505b3581c1fb77150c467ab92864 (fixed)
Vendor states this is fixed in 438f9a303ea8b55162b2d5376490c2ab3ec165a0 (fixed)
Vendor states this is fixed in 86183153c299e8bb1839e717286d6c6f39508a59 (fixed)
Vendor states this is fixed in 93bdf715d33cf5ee01c58e8546c2469c71ce082a (fixed)
Vendor states this is fixed in 9b7d77cb046b4487e8e511e04e62b6f416ce845c (fixed)
Vendor states this is fixed in c0def811ad8d642dca9b6d31a198cc39f5f90837 (fixed)
Vendor states this is fixed in dfaf235d5a6b60cbf115a14a656946303ad007b7 (fixed)
Vendor states this is fixed in 2.6.32 (unaffected)
Vendor states this is fixed in 5.10.252 (unaffected)
Vendor states this is fixed in 5.15.202 (unaffected)
Vendor states this is fixed in 6.1.165 (unaffected)
Vendor states this is fixed in 6.12.75 (unaffected)
Vendor states this is fixed in 6.18.14 (unaffected)
Vendor states this is fixed in 6.19.4 (unaffected)
Vendor states this is fixed in 6.6.128 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card