The Linux kernel vulnerability CVE-2026-45867 involves a use-after-free condition in the act8945a power supply driver. The root cause is the use of devm_ variants for requesting IRQ before allocating/registering the power_supply handle. Because devm_ deallocates resources in reverse order, the power_supply handle may be freed before the IRQ handler is unregistered. This race condition allows an interrupt to trigger after the handle is freed but before IRQ unregistration, causing the IRQ handler to call power_supply_changed() on a freed handle. A similar race can occur during probe if an interrupt fires before the power_supply handle is registered, leading to use of an uninitialized handle. The fix involves requesting the IRQ only after the power_supply handle registration to prevent this race.

Exploitation of this vulnerability can lead to system crashes or silent memory corruption due to use-after-free of kernel objects. This affects system stability and security, potentially allowing attackers with local privileges to cause denial of service or escalate privileges by exploiting the corrupted state.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves changing the order of resource allocation to request the IRQ after registering the power_supply handle. Until an official patch is available, users should monitor vendor advisories and apply updates once released.