CVE-2026-91007

The user-mode syscall verifiers for the charger driver API in drivers/charger/chargerhandlers.c did not inspect the prop argument before copying union chargerpropval across the user/kernel boundary. Two members of that union are function pointers — statusnotification CHARGERPROPSTATUSNOTIFICATION...