The vulnerability in the Linux kernel's power supply subsystem (qcom_battmgr) was a use-after-free condition triggered by the qcom_battmgr_pdr_notify() function. This function queues enable_work when the PMIC GLINK service starts, and the worker uses container_of() to recover battmgr for firmware requests. Because the PMIC GLINK client remains on the client list until its devres release action runs, a PDR notification could continue queueing work. This allowed a pending or running worker to access battmgr after it was freed by devres. The fix involved making enable_work device-managed with devm_work_autocancel(), registered before the PMIC GLINK client allocation, ensuring the client is released first and the work is canceled before battmgr is freed. The issue was discovered via an in-house static analysis tool.

The vulnerability could lead to use-after-free memory access in the Linux kernel's Qualcomm battery manager component. This could potentially cause kernel crashes or undefined behavior, impacting system stability. There is no indication of known exploits in the wild.

A fix has been implemented in the Linux kernel source code that makes the enable_work device-managed and ensures proper cancellation before freeing battmgr. Users should update to the fixed kernel version once available. No additional mitigation steps are specified.