CVE-2026-89473

Received Received - Intake

BaseFortify

Publication date: 2026-09-11

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power_supply reference leak bq25890_fw_probe() acquires a reference to a secondary charger using power_supply_get_by_name(), but the reference is not released on later probe failures or on driver detach. In particular, failures after bq25890_fw_probe() returns successfully, such as a failure in bq25890_hw_init(), also leak the reference. Register a device-managed cleanup action immediately after acquiring the secondary charger. This releases the reference on all subsequent probe failures and on driver detach. Found by code review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-18

NVD

CVE-2026-89473

EUVD

EUVD-2026-76379

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	d54bf877fd878ee45cbc88d399fb98b0b1c4484d
Linux	Linux	d54bf877fd878ee45cbc88d399fb98b0b1c4484d
Linux	Linux	d54bf877fd878ee45cbc88d399fb98b0b1c4484d
Linux	Linux	d54bf877fd878ee45cbc88d399fb98b0b1c4484d
Linux	Linux	d54bf877fd878ee45cbc88d399fb98b0b1c4484d
Linux	Linux	6.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a power supply reference leak in the Linux kernel's bq25890 driver. The issue occurs when the driver acquires a reference to a secondary charger using power_supply_get_by_name() but fails to release it during probe failures or driver detachment. This leads to a memory leak where the reference remains allocated.

Detection Guidance

This vulnerability is specific to the Linux kernel's bq25890 power supply driver and involves a reference leak in the power_supply subsystem. Detection requires checking for kernel logs or driver issues related to the bq25890 module. Use commands like 'dmesg | grep bq25890' or 'journalctl -k | grep bq25890' to identify probe failures or reference leaks.

Impact Analysis

The impact is primarily on system stability and resource usage. A leaked reference can cause gradual memory exhaustion, leading to degraded performance or crashes over time. It may also affect the functionality of power management systems relying on the bq25890 driver.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it involves a power supply reference leak in the Linux kernel, which is unrelated to data protection or privacy requirements.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-89473. If updating is not immediately possible, monitor the affected systems for power supply driver issues and avoid unloading/reloading the bq25890 module until patched.

Hi! I’m here to help you understand CVE-2026-89473. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70