CVE-2026-74271power: supply: core: fix supplied_from allocations
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix supplied_from allocations If dts property power-supplies has multiple values, then accessing to psy->supplied_from[i-1] in __power_supply_populate_supplied_from will overrun supplied_from array.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f6e0b081fb300a4601b064346963cf6bb163f437 before ae55e4bf18ee0c4c170797dd65e17dbdf644fcf2; from f6e0b081fb300a4601b064346963cf6bb163f437 before 23a29ee1d9de38b7d6226b27653bc736b28ff05a; from f6e0b081fb300a4601b064346963cf6bb163f437 before fefc9dad30d545be288d50a0b10d00465015fcfe; from f6e0b081fb300a4601b064346963cf6bb163f437 before d0503357653ee62188987a26baa2d7f3689f367e; from f6e0b081fb300a4601b064346963cf6bb163f437 before 14357ba006e1586e4b4e809c074b21baf0aa4c4b; from f6e0b081fb300a4601b064346963cf6bb163f437 before ba61aed9a34671222d1149acfc2f0179a9ce7e80 | CNA record |
References
- https://git.kernel.org/stable/c/ae55e4bf18ee0c4c170797dd65e17dbdf644fcf2
- https://git.kernel.org/stable/c/23a29ee1d9de38b7d6226b27653bc736b28ff05a
- https://git.kernel.org/stable/c/fefc9dad30d545be288d50a0b10d00465015fcfe
- https://git.kernel.org/stable/c/d0503357653ee62188987a26baa2d7f3689f367e
- https://git.kernel.org/stable/c/14357ba006e1586e4b4e809c074b21baf0aa4c4b
- https://git.kernel.org/stable/c/ba61aed9a34671222d1149acfc2f0179a9ce7e80
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.