CVE-2026-89469
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg->work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it. Free the IRQ first so the threaded handler is quiesced and can no longer queue work, then cancel the delayed work to drain the final generation. This issue was found by an in-house static analysis tool.
INFO
Published Date :
Sept. 11, 2026, 8:19 p.m.
Last Modified :
Sept. 14, 2026, 1:19 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Free the IRQ to quiesce the threaded handler.
- Cancel the delayed work to drain the final generation.
- Apply the patch to resolve the use-after-free vulnerability.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-89469.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-89469 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-89469
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-89469 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-89469 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 14, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89469.json">CVE-2026-89469</a> Added Reference https://git.kernel.org/stable/c/035cc6bc4d412dd4302862e8f859b784fcd4653b Added Reference https://git.kernel.org/stable/c/1321a4e6247164312eabc6d07f88572da2ee308c Added Reference https://git.kernel.org/stable/c/6f0ce09d60a0e4fab6f9ebe8294750481f0c19dd Added Reference https://git.kernel.org/stable/c/dc1dc2837f8e53bde2f16d52a63f4142e21757f1 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 13, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 11, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg->work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it. Free the IRQ first so the threaded handler is quiesced and can no longer queue work, then cancel the delayed work to drain the final generation. This issue was found by an in-house static analysis tool. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89469.json">CVE-2026-89469</a> Added Reference https://git.kernel.org/stable/c/6ab3128292df67295de1b2a86f21d89cf6612a7e Added Reference https://git.kernel.org/stable/c/80d4e40a85ba524e66c8c748aa7bb19eaf2f69df Added Reference https://git.kernel.org/stable/c/ab6b1ad710bed7931540733ce145493fece8ceef Added Reference https://git.kernel.org/stable/c/ceb6ac43b0f591722401922ceb958ce2616935e0