CVE-2026-89465

Received Received - Intake

Race Condition in RT9455 Power Supply Driver Leads to Use-After-Free

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_work and batt_presence_work can also queue max_charging_time_work, while batt_presence_work can requeue itself. rt9455_remove() cancels max_charging_time_work before batt_presence_work. The latter can therefore queue max_charging_time_work after it has already been cancelled: rt9455_remove() workqueue cancel pwr_rdy_work cancel max_charging_time_work batt_presence_work queues max_charging_time_work cancel batt_presence_work return devres frees rt9455_info max_charging_time_work dereferences rt9455_info The IRQ also remains registered until devres cleanup and can queue more work after any of the cancellation calls. If rt9455_hw_init() fails after the IRQ has been requested, probe returns without cancelling work that may already have been queued. A pending callback can then access rt9455_info after it has been freed. Register rt9455_cancel_all_delayed_works() through devm_add_action_or_reset() right after devm_power_supply_register(). devres invokes the action in reverse registration order, after the managed IRQ has been freed and before rt9455_info is released, so the delayed works are drained in both rt9455_remove() and the probe error path. Cancel pwr_rdy_work and batt_presence_work before max_charging_time_work because both can queue the latter. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89465

EUVD

EUVD-2026-76371

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of delayed work in the rt9455 power supply driver. The issue occurs when work items like pwr_rdy_work, max_charging_time_work, and batt_presence_work are not properly quiesced before the driver is removed. This can lead to a use-after-free scenario where rt9455_info is accessed after it has been freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's rt9455 power supply driver and does not have network-based detection methods. It requires kernel-level inspection. Check if your system uses the rt9455 driver by running: lsmod | grep rt9455. If loaded, verify kernel logs for related errors using dmesg | grep rt9455.

Impact Analysis

This vulnerability could cause system instability or crashes if the rt9455 power supply driver is removed while work items are still pending. It may also lead to unexpected behavior in power management, potentially affecting battery charging or system shutdown processes.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel power supply driver (rt9455) issue. The flaw involves improper work queue handling leading to potential use-after-free scenarios, which is a reliability and security concern but not directly tied to data protection regulations.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-89465. If using a custom kernel, apply the patch from the Linux kernel source that addresses the rt9455 driver issue. Monitor kernel updates from your distribution.

Hi! I’m here to help you understand CVE-2026-89465. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70