Improper access control in Linux kernel - CVE-2026-64143
Published: July 20, 2026
Vulnerability identifier: #VU138480
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64143
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause permanent hardware damage to the battery.
The vulnerability exists due to improper access control in the uniwill-laptop battery charging limit feature when forcing the driver to enable the charging threshold interface on unsupported devices. A local user can enable the charging limit through the force module parameter to cause permanent hardware damage to the battery.
The issue affects some older device models that do not properly implement the charging threshold interface.
How to mitigate CVE-2026-64143
Install security update from vendor's repository.