Improper access control in Linux kernel - CVE-2026-64143

Vulnerability identifier: #VU138480

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-64143

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause permanent hardware damage to the battery.

The vulnerability exists due to improper access control in the uniwill-laptop battery charging limit feature when forcing the driver to enable the charging threshold interface on unsupported devices. A local user can enable the charging limit through the force module parameter to cause permanent hardware damage to the battery.

The issue affects some older device models that do not properly implement the charging threshold interface.

Linux kernel
Ubuntu
linux-ibm (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/26cbe119f99c86dcb4a0136d2bc73c0c716d80e4
• https://git.kernel.org/stable/c/c832a00c9b929b9ad26772833d425f520b2e09cd

• Improper access control in Linux kernel x86 uniwill driver
• Ubuntu update for linux-ibm
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia