CVE-2026-64230 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
regulator: tps65219: fix irq_data.rdev not being assigned
Commit 64a6b577490c ("regulator: tps65219: Remove debugging helper function") removed the tps65219_get_rdev_by_name() helper along with the irq_data.rdev assignment that depended on it. This left irq_data.rdev uninitialized for all IRQs, causing undefined behavior when regulator_notifier_call_chain() is called from the IRQ handler:
Internal error: Oops: 0000000096000004 pc : regulator_notifier_call_chain lr : tps65219_regulator_irq_handler Call trace: regulator_notifier_call_chain tps65219_regulator_irq_handler handle_nested_irq regmap_irq_thread irq_thread_fn irq_thread kthread ret_from_fork
Instead of restoring a dedicated lookup array, restructure the probe function to combine regulator registration with IRQ registration in the same loop. This way the rdev returned by devm_regulator_register() is naturally available for assigning to irq_data.rdev without any auxiliary data structure.
Non-regulator IRQs (SENSOR, TIMEOUT) that don't correspond to any registered regulator are registered with rdev=NULL, and the IRQ handler is protected with a NULL check to avoid crashing.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability in question affects the Linux kernel's tps65219 regulator driver, specifically addressing a critical initialization flaw that leads to undefined behavior during interrupt processing. This issue stems from a code refactoring commit that inadvertently removed essential rdev assignment logic within the interrupt data structure. The root cause lies in the removal of the tps65219_get_rdev_by_name() helper function along with its associated irq_data.rdev assignment, leaving the regulator device reference uninitialized for all interrupt handlers. When regulator_notifier_call_chain() is invoked from the IRQ handler context, this uninitialized rdev pointer triggers kernel oops conditions and system crashes.
The technical implementation flaw manifests as a classic null pointer dereference scenario where the interrupt data structure contains an uninitialized regulator device reference. This creates a dangerous race condition between regulator registration and interrupt handling operations, as documented in the call trace showing regulator_notifier_call_chain being called from tps65219_regulator_irq_handler. The vulnerability specifically impacts the kernel's regulator subsystem and can be classified under CWE-476 Null Pointer Dereference, representing a fundamental failure to properly initialize data structures before use. The issue demonstrates poor software engineering practices where code removal was performed without proper consideration of dependencies between different system components.
The operational impact of this vulnerability extends beyond simple system instability to potentially compromise device reliability and security in embedded systems that rely on the tps65219 power management controller. When triggered, the undefined behavior can lead to complete system crashes, requiring manual intervention or reboot cycles that may interrupt critical operations. The vulnerability affects any Linux kernel version containing the problematic commit, particularly impacting devices using TI's tps65219 regulator chips in mobile phones, tablets, and embedded systems where power management stability is crucial.
The fix implemented addresses this through a restructured probe function approach that eliminates the need for auxiliary data structures by combining regulator registration with IRQ registration within the same loop iteration. This architectural solution ensures that the rdev returned by devm_regulator_register() is naturally available for assignment to irq_data.rdev without requiring additional lookup mechanisms. The mitigation strategy follows best practices for embedded system development and aligns with ATT&CK technique T1484.001 for privilege escalation through kernel exploitation, though this particular vulnerability does not directly enable privilege escalation. Non-regulator IRQs that do not correspond to registered regulators are properly handled by assigning rdev=NULL and incorporating NULL checks in the IRQ handler to prevent crashes, providing robust error handling that aligns with secure coding standards recommended by the Linux Kernel Security Team.
The resolution demonstrates proper software engineering principles where code refactoring maintains functional integrity while preserving system stability. The approach avoids reintroducing the removed debugging helper function that was originally causing complexity, instead implementing a cleaner design pattern that naturally associates regulator and interrupt registration operations. This solution prevents potential future regressions and aligns with the Linux kernel's emphasis on robust device driver development practices. The fix specifically addresses the security implications of uninitialized memory access patterns that could potentially be exploited in more complex attack scenarios involving kernel memory corruption, though the immediate threat is limited to system stability issues rather than direct exploitation vectors.