CVE-2026-19809

The user-mode system call verifier zvrfychargergetprop in drivers/charger/chargerhandlers.c declares an uninitialized union chargerpropval kval on the kernel privileged stack, passes it to the charger driver back end via zimplchargergetprop, and then copies the full sizeofunion chargerpropval bac...