CVE-2026-46270: power: supply: rt9455: Fix use-after-free in power_supply_changed()

Synopsis

A use-after-free vulnerability exists in the Linux kernel's rt9455 power supply driver, specifically in the ordering of devm_ resource registration during device probe and removal. The bug is reachable locally with no authentication required, as an attacker or racing interrupt needs only an existing presence on the host. Successful exploitation crashes the system or silently corrupts kernel memory, enabling full confidentiality, integrity, and availability impact. Patched-image rebuilds at the fix versions (5.10.252, 5.15.202, 6.1.165, and the upstream commit) are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the vulnerable service is required.

• AuthenticationNot required

  No credentials or account privileges are needed to trigger the race condition between interrupt firing and IRQ handler deregistration.

• Victim interactionNot required

  No user or administrator action is required; the vulnerability can be triggered by the attacker or by normal interrupt activity during device removal.

• Attack complexityDetail

  Attack complexity is low, meaning the race condition is reliably triggerable without requiring specific memory layouts, timing precision beyond normal removal sequences, or other environmental prerequisites.

Blast Radius

• Kernel memory is corrupted or overwritten when the freed power_supply handle is accessed by the interrupt handler, giving an attacker influence over arbitrary kernel data structures.
• The system crashes outright (kernel panic) when the use-after-free dereferences an invalid pointer, disrupting all workloads on the affected host.
• Silent memory corruption can persist across the crash window, allowing an attacker to manipulate kernel objects and escalate privileges or leak sensitive kernel memory contents.
• All running processes and stored data on the host are at risk because the vulnerability operates at kernel privilege level with no sandboxing boundary.