CVE-2026-99215: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99215 is a use-after-free vulnerability in the Linux kernel's power supply core module (power: supply: core) that can lead to kernel crashes or potentially arbitrary code execution. The flaw exists because a power supply can be unregistered while its callbacks are still executing, allowing driver data to be freed while still in use. It affects Linux kernel versions from 4.1 onward, with fixes available in stable commits targeting the 6.18.x and 7.2.x branches. The vulnerability was published on October 28, 2026, and is estimated to be of Medium severity (GitHub Advisory, Feedly).

The root cause is a race condition (use-after-free, CWE-416) in the Linux kernel's power supply core: once a power supply is registered, callbacks such as external_power_changed() (triggered by the TCPM stack) can fire immediately from other kernel contexts. If the power supply is unregistered concurrently — for example, because the underlying hardware bus (e.g., I2C) malfunctions shortly after registration — the driver may free its data structures while queued callbacks are still accessing them. The fix introduces a read-write semaphore between external_power_changed() and power_supply_unregister() to ensure the latter blocks until all in-flight callbacks complete. The crash manifests as a NULL pointer dereference in __power_supply_is_supplied_by+0x18/0x100, as shown in the kernel oops trace (GitHub Advisory).

Successful exploitation can cause a kernel panic/crash (denial of service) on affected Linux systems, as demonstrated by the NULL pointer dereference oops in the provided crash trace. In more targeted scenarios, a local attacker who can induce hardware bus failures (e.g., I2C bus hangs or device disconnections) may be able to exploit the use-after-free condition to achieve local privilege escalation or arbitrary kernel code execution. The impact is limited to local access — remote exploitation is not applicable given the hardware-triggered nature of the race condition (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). Exploitation requires local access and the ability to trigger hardware bus malfunctions (e.g., I2C bus hangs) at a precise timing window during power supply registration and unregistration, making opportunistic exploitation unlikely. No threat actor attribution, EPSS score, or CISA KEV catalog entry has been identified for this CVE.

1. Local Access: Obtain local access to a Linux system running a vulnerable kernel (version 4.1 or later, prior to the patched stable commits).
2. Identify Target Subsystem: Confirm the system uses a power supply device managed via the Linux power supply core (e.g., a battery charger IC connected over I2C, such as a BQ257xx).
3. Trigger Hardware Bus Malfunction: Induce an I2C bus hang or device disconnection (e.g., via a malfunctioning peripheral or deliberate bus contention) immediately after the power supply driver registers its device, causing the driver to initiate removal while callbacks are still queued.
4. Race Condition Exploitation: The kernel's power_supply_changed_work workqueue processes queued callbacks (e.g., bq257xx_external_power_changed) while the driver concurrently frees its data structures during power_supply_unregister().
5. Trigger Use-After-Free: The callback accesses freed driver data, resulting in a NULL pointer dereference or use-after-free condition — leading to a kernel crash or, in a controlled scenario, potential arbitrary kernel code execution (GitHub Advisory).

• Logs: Kernel oops messages referencing __power_supply_is_supplied_by, __power_supply_am_i_supplied, or power_supply_changed_work in /var/log/kern.log or dmesg output; stack traces showing bq257xx_external_power_changed or similar power supply driver callbacks.
• Logs: Messages indicating Unable to handle kernel NULL pointer dereference with ESR 0x0000000096000004 or similar memory abort info.
• Process: Unexpected kernel worker thread (kworker) crashes or hangs associated with the events workqueue processing power_supply_changed_work.
• Hardware: Repeated I2C bus error messages or device timeout warnings in kernel logs preceding a system crash, indicating the hardware condition that triggers the race (GitHub Advisory).

Apply the kernel patches available at the following stable commits: 2ac0256a28e15c4888fa394d1fe66cf7b1d58090, 45388e50d14bc161873b14b9a05d4b8b8822fca6, and 5b4bd13e0552926648a46c2c9a12a24dfaee3715, targeting the 6.18.x and 7.2.x stable branches. Fixed versions are 6.18.59 (for the 6.18.x series) and 7.2.13 (for the 7.2.x series) and later. As a workaround where patching is not immediately possible, monitor and mitigate I2C bus instability to reduce the likelihood of triggering the race condition (GitHub Advisory, Kernel Announcement).