---
id: CVE-2026-74271
title: 'power: supply: core: fix supplied_from allocations'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  power: supply: core: fix supplied_from allocations

  If dts property power-supplies has multiple values, then accessing to
  psy->supplied_from[i-1] in __power_supply_popu…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 <
    ae55e4bf18ee0c4c170797dd65e17dbdf644fcf2
  - >-
    Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 <
    23a29ee1d9de38b7d6226b27653bc736b28ff05a
  - >-
    Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 <
    fefc9dad30d545be288d50a0b10d00465015fcfe
  - >-
    Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 <
    d0503357653ee62188987a26baa2d7f3689f367e
  - >-
    Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 <
    14357ba006e1586e4b4e809c074b21baf0aa4c4b
  - >-
    Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 <
    ba61aed9a34671222d1149acfc2f0179a9ce7e80
  - Linux 3.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:55:47.284724Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:43.321Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74271'
references:
  - url: 'https://git.kernel.org/stable/c/ae55e4bf18ee0c4c170797dd65e17dbdf644fcf2'
  - url: 'https://git.kernel.org/stable/c/23a29ee1d9de38b7d6226b27653bc736b28ff05a'
  - url: 'https://git.kernel.org/stable/c/fefc9dad30d545be288d50a0b10d00465015fcfe'
  - url: 'https://git.kernel.org/stable/c/d0503357653ee62188987a26baa2d7f3689f367e'
  - url: 'https://git.kernel.org/stable/c/14357ba006e1586e4b4e809c074b21baf0aa4c4b'
  - url: 'https://git.kernel.org/stable/c/ba61aed9a34671222d1149acfc2f0179a9ce7e80'
tags:
  - cve.org
epss: 0.00215
epssPercentile: 0.11894
ingestedAt: '2026-11-06T18:00:12.566Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

power: supply: core: fix supplied_from allocations

If dts property power-supplies has multiple values, then accessing to
psy->supplied_from[i-1] in __power_supply_populate_supplied_from will
overrun supplied_from array.

## Affected

- `Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 < ae55e4bf18ee0c4c170797dd65e17dbdf644fcf2`
- `Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 < 23a29ee1d9de38b7d6226b27653bc736b28ff05a`
- `Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 < fefc9dad30d545be288d50a0b10d00465015fcfe`
- `Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 < d0503357653ee62188987a26baa2d7f3689f367e`
- `Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 < 14357ba006e1586e4b4e809c074b21baf0aa4c4b`
- `Linux >= f6e0b081fb300a4601b064346963cf6bb163f437 < ba61aed9a34671222d1149acfc2f0179a9ce7e80`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.