CVE-2026-74271

A flaw was found in the Linux kernel's power supply core component. When the device tree (dts) property power-supplies has multiple values, an array overrun can occur in the __power_supply_populate_supplied_from function due to incorrect memory allocation. This vulnerability could lead to memory corruption, potentially causing system instability or denial of service.

Red Hat has evaluated this issue as having a Moderate severity impact because exploitation requires local access on systems configured with specialized Device Tree definitions, limiting the blast radius across typical enterprise deployments. Standard x86 server installations rely on ACPI rather than Device Tree nodes and are not exposed to this condition under default configurations. On platforms that utilize Device Tree descriptions, such as certain embedded or ARM architectures, triggering the issue requires specific hardware topologies configured during boot.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.