CVE-2026-99215

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> power: supply: core: prevent unregistering a power supply while a callback runs<br /> <br /> Once a power supply is registered, its callbacks can immediately start<br /> firing from other contexts, such as external_power_changed() triggered by<br /> the TCPM stack. If a power supply is unregistered while the callback is<br /> still running, the driver data can already be freed when the callback<br /> tries to access it, leading to a use-after-free.<br /> <br /> This happens e.g. when the hardware bus carrying the power supply device<br /> malfunctions (e.g. I2C is hogged down by another malfunctioning device)<br /> immediately after the power supply is registered, and thus the core is<br /> still processing the callbacks which were queued up when the driver<br /> starts the removal, leading in some cases to a kernel crash, e.g.:<br /> <br /> [ 11.645942] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000005<br /> [ 11.646751] Mem abort info:<br /> [ 11.647006] ESR = 0x0000000096000004<br /> [ 11.647338] EC = 0x25: DABT (current EL), IL = 32 bits<br /> [ 11.647806] SET = 0, FnV = 0<br /> [ 11.648077] EA = 0, S1PTW = 0<br /> [ 11.648356] FSC = 0x04: level 0 translation fault<br /> [ 11.648785] Data abort info:<br /> [ 11.649041] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000<br /> [ 11.649524] CM = 0, WnR = 0, TnD = 0, TagAccess = 0<br /> [ 11.649981] GCS = 0, Overlay = 0, DirtyBit = 0<br /> [ 11.650390] [0000000000000005] user address but active_mm is swapper<br /> [ 11.650955] Internal error: Oops: 0000000096000004 [#1] SMP<br /> [ 11.651460] Modules linked in:<br /> [ 11.651742] CPU: 1 UID: 0 PID: 144 Comm: kworker/1:2 Not tainted 7.2.0-rc6-g62a9297af2cd #1 PREEMPT<br /> [ 11.652553] Hardware name: Flipper One rev. F0B1C2 (DT)<br /> [ 11.653024] Workqueue: events power_supply_changed_work<br /> [ 11.653511] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 11.654135] pc : __power_supply_is_supplied_by+0x18/0x100<br /> [ 11.654624] lr : __power_supply_am_i_supplied+0x40/0xb8<br /> [ 11.655098] sp : ffff80008192bb30<br /> [ 11.655399] x29: ffff80008192bb30 x28: 0000000000000000 x27: 0000000000000000<br /> [ 11.656049] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000<br /> [ 11.656695] x23: ffff0000c19f4200 x22: ffffdb2232ba4ea8 x21: ffff80008192bc28<br /> [ 11.657344] x20: ffff0000c1eef000 x19: ffff80008192bc18 x18: 00000000a0886e62<br /> [ 11.657991] x17: 000000040044ffff x16: 04500072b5503510 x15: 0000000000000000<br /> [ 11.658639] x14: 0000000000000000 x13: 0000000000000220 x12: 0000000000000000<br /> [ 11.659286] x11: 0000000000000000 x10: ffff0000c1fdb2b0 x9 : ffffdb2232ba5590<br /> [ 11.659934] x8 : 00000000e5b906e6 x7 : ffff0000c2502778 x6 : ffffdb22339793d0<br /> [ 11.660581] x5 : ffff80008192bc18 x4 : ffff0000c19cbca0 x3 : 0000000000000000<br /> [ 11.661228] x2 : ffff0000c1fdaf40 x1 : ffffffffffffffed x0 : ffff0000c1eef000<br /> [ 11.661878] Call trace:<br /> [ 11.662103] __power_supply_is_supplied_by+0x18/0x100 (P)<br /> [ 11.662596] __power_supply_am_i_supplied+0x40/0xb8<br /> [ 11.663040] psy_for_each_psy_cb+0x20/0x40<br /> [ 11.663416] class_for_each_device+0x110/0x150<br /> [ 11.663825] power_supply_am_i_supplied+0x68/0x100<br /> [ 11.664262] bq257xx_external_power_changed+0x58/0x140<br /> [ 11.664733] __power_supply_changed_work+0x60/0x80<br /> [ 11.665170] psy_for_each_psy_cb+0x20/0x40<br /> [ 11.665545] class_for_each_device+0x110/0x150<br /> [ 11.665953] power_supply_changed_work+0x98/0x1b8<br /> [ 11.666382] process_one_work+0x164/0x4c0<br /> [ 11.666758] worker_thread+0x19c/0x320<br /> [ 11.667104] kthread+0x138/0x150<br /> [ 11.667408] ret_from_fork+0x10/0x20<br /> [ 11.667744] Code: d503233f a9bd7bfd 910003fd a90153f3 (f9400c34)<br /> [ 11.668294] ---[ end trace 0000000000000000 ]---<br /> <br /> Add a read-write semaphore between external_power_changed() and<br /> power_supply_unregister() to prevent the latter from returning (and thus<br /> the driver from freeing its data) while the callback is still running.