The Linux kernel vulnerability CVE-2026-45882 involves a use-after-free condition in the pm8916_bms_vm power supply driver. The root cause is the use of devm_ variants for IRQ request and power_supply registration in the wrong order, leading to the power_supply handle being freed before the IRQ handler is unregistered during device removal. This race condition allows an interrupt to invoke power_supply_changed() with a freed or uninitialized power_supply handle, causing system crashes or memory corruption. The vulnerability also affects the probe phase where interrupts may occur before the power_supply handle is registered. The resolution is to reorder the calls so that the IRQ is requested after the power_supply handle is registered, preventing the race.

Exploitation of this vulnerability can cause system crashes or silent memory corruption due to use-after-free of the power_supply handle in interrupt context. This impacts system stability and reliability, potentially leading to denial of service or unpredictable behavior. The vulnerability affects local privilege levels with low attack complexity and no user interaction required, with high confidentiality, integrity, and availability impact as per CVSS 3.1 metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves changing the order of resource allocation to request the IRQ after registering the power_supply handle. Until an official patch is available, avoid using affected driver versions or apply any vendor-provided temporary fixes. Monitor vendor advisories for updates.