CVE-2026-89475

Received Received - Intake

Use-After-Free in Linux Kernel Power Supply Subsystem

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove() returns. remove() cancels bq->iilimit_setup_work while the threaded handler can still fire; that handler reschedules the work and dereferences bq, so the work runs against freed memory once devm frees bq. Make the delayed work device-managed with devm_delayed_work_autocancel(), registered before the interrupt request. The devm cleanup then releases the interrupt first, so the handler can no longer reschedule the work, and cancels the work before bq is freed. The explicit cancel_delayed_work_sync() in remove() is no longer needed and is dropped. Found by static analysis.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89475

EUVD

EUVD-2026-76381

Affected Vendors & Products

Vendor	Product	Version / Range
ti	bq24257	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's power supply subsystem, specifically in the bq24257 battery charger driver. The issue occurs when the device is removed. The STAT-pin interrupt remains active until cleanup, but the remove function cancels a work item while the interrupt handler can still trigger it. The handler reschedules the work, which then accesses freed memory when the device is cleaned up.

Detection Guidance

This vulnerability is specific to the Linux kernel's power supply subsystem for the bq24257 device driver. Detection requires checking the kernel version and the presence of the affected driver. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep bq24257' to see if the driver is loaded.

Impact Analysis

This vulnerability could lead to system crashes or unexpected behavior if the affected driver is used. An attacker with local access might exploit it to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's power supply subsystem (bq24257) that could lead to memory corruption or crashes, but there is no evidence it involves data exposure or privacy violations relevant to these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-89475. If updating is not immediately possible, consider disabling the bq24257 driver if it is not required for system operation.

Hi! I’m here to help you understand CVE-2026-89475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70