CVE-2026-89467
Received Received - Intake

Use-After-Free in Linux Kernel Power Supply Subsystem

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: fix use-after-free qcom_battmgr_pdr_notify() queues enable_work when the PMIC GLINK service comes up, and the worker recovers battmgr through container_of() to issue firmware requests. The PMIC GLINK client stays on the client list until its devres release action runs, so a PDR notification can keep queueing the work, and a pending or running worker can access battmgr after devres frees it. Make enable_work device-managed with devm_work_autocancel(), registered before the PMIC GLINK client is allocated. The devres cleanup then releases the client first, so no further notification can queue the work, and cancels the work before battmgr is freed. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89467
EUVD
EUVD-2026-76373

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qualcomm qcom_battmgr *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's power supply subsystem, specifically in the Qualcomm battery manager (qcom_battmgr). It occurs when a worker function accesses freed memory due to improper cleanup of a PMIC GLINK client. The issue arises because notifications can queue work even after the battery manager is freed, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's power supply subsystem, particularly the qcom_battmgr module. Detection requires checking kernel logs for use-after-free errors related to qcom_battmgr or PMIC GLINK notifications. Use commands like dmesg | grep -i 'qcom_battmgr' or journalctl -k | grep -i 'use-after-free' to identify suspicious activity.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior on Linux systems using Qualcomm battery management. It may lead to data loss or require a reboot to restore normal operation. Systems with frequent battery or power state changes are more likely to trigger this issue.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a distribution kernel, apply the latest security updates. For custom kernels, backport the fix from the upstream Linux kernel commit addressing this use-after-free in qcom_battmgr.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89467. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart