CVE-2026-89465

Status: UPDATED  |  Advisory ID: CVE-2026-89465

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

power: supply: rt9455: quiesce delayed work before teardown

The threaded IRQ handler can queue pwr_rdy_work,

max_charging_time_work and batt_presence_work. pwr_rdy_work and

batt_presence_work can also queue max_charging_time_work, while

batt_presence_work can requeue itself.

rt9455_remove() cancels max_charging_time_work before

batt_presence_work. The latter can therefore queue

max_charging_time_work after it has already been cancelled:

rt9455_remove() workqueue

cancel pwr_rdy_work

cancel max_charging_time_work

batt_presence_work queues

max_charging_time_work

cancel batt_presence_work

return

devres frees rt9455_info

max_charging_time_work dereferences

rt9455_info

The IRQ also remains registered until devres cleanup and can queue more

work after any of the cancellation calls. If rt9455_hw_init() fails

after the IRQ has been requested, probe returns without cancelling work

that may already have been queued. A pending callback can then access

rt9455_info after it has been freed.

Register rt9455_cancel_all_delayed_works() through

devm_add_action_or_reset() right after devm_power_supply_register().

devres invokes the action in reverse registration order, after the

managed IRQ has been freed and before rt9455_info is released, so the

delayed works are drained in both rt9455_remove() and the probe error

path. Cancel pwr_rdy_work and batt_presence_work before

max_charging_time_work because both can queue the latter.

This issue was found by an in-house static analysis tool. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References