CVE-2026-89474

Received Received - Intake

USB-PHY Notifier Race Condition in Linux Kernel Power Supply

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb_work before freeing the charger The USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq->charger). The reset devm action only unregisters the notifier and was registered before the power supplies, so devm frees bq->charger on unwind before the action runs; a usb_work still queued can then dereference it. Register the reset action after the power supplies, so it unregisters the notifiers and drains usb_work before the supplies are released. Initialize usb_work and obtain the PHY references before registering the notifiers, so the worker cannot run before the supplies exist. Found by static analysis.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89474

EUVD

EUVD-2026-76380

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the bq256xx power supply driver. The issue occurs when the USB-PHY notifier queues a work item (usb_work) that calls power_supply_changed on a charger structure. The devm cleanup action unregisters the notifier before the power supplies, causing the charger structure to be freed while usb_work is still queued. This can lead to a use-after-free scenario when usb_work tries to access the freed charger structure.

Detection Guidance

This vulnerability is specific to the Linux kernel's power supply subsystem (bq256xx driver) and does not have network-based detection methods. It requires kernel-level inspection. Check if your system uses the affected driver by running: lsmod | grep bq256xx. If loaded, verify kernel logs for related errors using dmesg | grep bq256xx.

Impact Analysis

If exploited, this vulnerability could cause system instability, crashes, or potential privilege escalation. Systems using affected Linux kernel versions with the bq256xx driver may experience kernel panics or unexpected behavior when USB power events occur.

Mitigation Strategies

Update your Linux kernel to the latest patched version where this issue is resolved. If immediate patching is not possible, avoid using systems with the bq256xx driver until patched. Monitor kernel logs for related errors as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-89474. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70