CVE-2026-45869

power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()

published May 27, 2026

CVSS
—
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()

In `probe()`, `request_irq()` is called before allocating/registering a

`power_supply` handle. If an interrupt is fired between the call to

`request_irq()` and `power_supply_register()`, the `power_supply` handle

will be used uninitialized in `power_supply_changed()` in

`wm97xx_bat_update()` (triggered from the interrupt handler). This will

lead to a `NULL` pointer dereference since

Fix this racy `NULL` pointer dereference by making sure the IRQ is

requested _after_ the registration of the `power_supply` handle. Since

the IRQ is the last thing requests in the `probe()` now, remove the

error path for freeing it. Instead add one for unregistering the

`power_supply` handle when IRQ request fails.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Published
2026-05-27T12:15Z
EPSS history
Timeline
  • 27 MAY 12:15Z
    power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()
    cvelistv5