The Linux kernel vulnerability CVE-2026-45885 involves a use-after-free condition in the cpcap-battery power supply driver. The root cause is the ordering of resource management: the IRQ is requested before the power_supply handle is registered, leading to a race during device removal. An interrupt can trigger after the power_supply handle is freed but before the IRQ handler is unregistered, causing the handler to call power_supply_changed() with a freed handle. This results in system crashes or silent memory corruption. A similar race during probe can cause use of an uninitialized handle. The resolution is to request the IRQ only after the power_supply handle is registered, ensuring proper allocation and deallocation order.

Exploitation of this vulnerability can cause system crashes or silent memory corruption due to use-after-free in the power supply interrupt handler. This affects system stability and reliability, potentially leading to denial of service. There are no known exploits in the wild reported. The vulnerability requires local privileges to trigger (local attack vector) and has high impact on confidentiality, integrity, and availability as per CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves changing the order of IRQ request and power_supply handle registration to prevent the race condition. Until an official fix is available, avoid using affected drivers or kernel versions in environments where this vulnerability could be triggered. Monitor vendor advisories for an official patch or update.