A local privilege escalation vulnerability in the Linux kernel power supply subsystem allows a local attacker to trigger a use-after-free condition, potentially leading to system compromise.

This is a use-after-free vulnerability occurring within the charger-manager component of the power supply subsystem. It is triggered when a local, authenticated user interacts with specific sysfs attributes during the driver removal process, resulting in the dereference of freed memory handles.

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk for local environments. A successful exploit allows a local attacker with low privileges to escalate their access, potentially leading to full system compromise, unauthorized data access, or denial of service through kernel crashes.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages specifically related to the charger-manager or power supply drivers, which may indicate attempted exploitation.

Compensating Controls: Restrict local shell access to untrusted users and enforce strict permissions on sysfs interfaces where possible to limit the attack surface for local users.

Public Exploit Available: Unknown

Given the potential for privilege escalation, administrators should prioritize patching the kernel across all affected environments. While the attack vector is local, the severity warrants a swift update cycle to ensure kernel integrity and prevent unauthorized escalation of privileges.