VulnerabilityPublished 3 Jun 2026Updated 6 Nov 2026

CVE-2026-46252: Linux kernel · regulator: core: fix locking in regulator_resolve_supply() error path

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in e77357dc2293283fc08a485b1e2e571d91d02622 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:34 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in e77357dc2293283fc08a485b1e2e571d91d02622, c84860dac7af7dc3c3e3c9ae86d65e222c2f3b0c, c66e0db0f37290b53c57994f998bb55590364fd0 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 36a1f1b6ddc6d1442424e29548e790633ca39c7b, < e77357dc2293283fc08a485b1e2e571d91d02622	Fixed in e77357dc2293283fc08a485b1e2e571d91d02622
LinuxLinux	Affected ≥ 36a1f1b6ddc6d1442424e29548e790633ca39c7b, < c84860dac7af7dc3c3e3c9ae86d65e222c2f3b0c	Fixed in c84860dac7af7dc3c3e3c9ae86d65e222c2f3b0c
LinuxLinux	Affected ≥ 36a1f1b6ddc6d1442424e29548e790633ca39c7b, < c66e0db0f37290b53c57994f998bb55590364fd0	Fixed in c66e0db0f37290b53c57994f998bb55590364fd0
LinuxLinux	Affected ≥ 36a1f1b6ddc6d1442424e29548e790633ca39c7b, < bde74af8d4466213007bdd42cc85fa72c861dea7	Fixed in bde74af8d4466213007bdd42cc85fa72c861dea7
LinuxLinux	Affected ≥ 36a1f1b6ddc6d1442424e29548e790633ca39c7b, < a8a2eab1166bc33ee38ca371cff425bdb5681e47	Fixed in a8a2eab1166bc33ee38ca371cff425bdb5681e47
LinuxLinux	Affected ≥ 36a1f1b6ddc6d1442424e29548e790633ca39c7b, < 60747114fd2a38739130b715e7b2d40ce848f0be	Fixed in 60747114fd2a38739130b715e7b2d40ce848f0be

Description

In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix locking in regulator_resolve_supply() error path If late enabling of a supply regulator fails in regulator_resolve_supply(), the code currently triggers a lockdep warning: WARNING: drivers/regulator/core.c:2649 at _regulator_put+0x80/0xa0, CPU#6: kworker/u32:4/596 ... Call trace: _regulator_put+0x80/0xa0 (P) regulator_resolve_supply+0x7cc/0xbe0 regulator_register_resolve_supply+0x28/0xb8 as the regulator_list_mutex must be held when calling _regulator_put(). To solve this, simply switch to using regulator_put(). While at it, we should also make sure that no concurrent access happens to our rdev while we clear out the supply pointer. Add appropriate locking to ensure that. While the code in question will be removed altogether in a follow-up commit, I believe it is still beneficial to have this corrected before removal for future reference.

References

Community reviews

Loading reviews…