CVE-2026-45869
In the Linux kernel, the following vulnerability has been resolved: power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() In `probe()`, `request_irq()` is called before allocating/registering a `power_supply` handle. If an interrupt is fired between the call to `request_irq()` and `power_supply_register()`, the `power_supply` handle will be used uninitialized in `power_supply_changed()` in `wm97xx_bat_update()` (triggered from the interrupt handler). This will lead to a `NULL` pointer dereference since Fix this racy `NULL` pointer dereference by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Since the IRQ is the last thing requests in the `probe()` now, remove the error path for freeing it. Instead add one for unregistering the `power_supply` handle when IRQ request fails.
Affected versions
Linux kernel versions
2.6.32
and later are affected. Fixed in
5.10.252,
5.15.202,
6.1.165,
6.6.128,
6.12.75,
6.18.14,
6.19.4,
7.0
and their respective stable series.
References
The following references provide additional information about CVE-2026-45869 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/39fe0eac6d755ef215026518985fcf8de9360e9e
-
PatchKernel patch commithttps://git.kernel.org/stable/c/3d7b5391bb95505b3581c1fb77150c467ab92864
-
PatchKernel patch commithttps://git.kernel.org/stable/c/438f9a303ea8b55162b2d5376490c2ab3ec165a0
Frequently asked questions
-
What is CVE-2026-45869?
CVE-2026-45869 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.32 onward and has been patched in 5.10.252, 5.15.202, 6.1.165 and others. CVE-2026-45869 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-45869?
Yes — CVE-2026-45869 has been patched. Fixed versions include 5.10.252, 5.15.202, 6.1.165 and others. If you are running Linux kernel 2.6.32 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-45869 actively exploited?
No — CVE-2026-45869 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.