CVE-2026-89475
power: supply: bq24257: fix use-after-free on remove
Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove() returns. remove() cancels bq->iilimit_setup_work while the threaded handler can still fire; that handler reschedules the work and dereferences bq, so the work runs against freed memory once devm frees bq. Make the delayed work device-managed with devm_delayed_work_autocancel(), registered before the interrupt request. The devm cleanup then releases the interrupt first, so the handler can no longer reschedule the work, and cancels the work before bq is freed. The explicit cancel_delayed_work_sync() in remove() is no longer needed and is dropped. Found by static analysis.
INFO
Published Date :
Sept. 11, 2026, 8:19 p.m.
Last Modified :
Sept. 14, 2026, 1:19 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel to include the fix.
- Ensure device-managed delayed work is registered before interrupt.
- Remove explicit cancel_delayed_work_sync() calls.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-89475.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-89475 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-89475
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-89475 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-89475 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 14, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89475.json">CVE-2026-89475</a> Added Reference https://git.kernel.org/stable/c/6d2eb93975c07b0169a3287efc1ae3b60cf52d8e Added Reference https://git.kernel.org/stable/c/9d77fd7dd9a3ad57f7655c5264b503b85adbb7b8 Added Reference https://git.kernel.org/stable/c/a279e64c907f5638bb34cb8e2c9285798cf5f690 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 11, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove() returns. remove() cancels bq->iilimit_setup_work while the threaded handler can still fire; that handler reschedules the work and dereferences bq, so the work runs against freed memory once devm frees bq. Make the delayed work device-managed with devm_delayed_work_autocancel(), registered before the interrupt request. The devm cleanup then releases the interrupt first, so the handler can no longer reschedule the work, and cancels the work before bq is freed. The explicit cancel_delayed_work_sync() in remove() is no longer needed and is dropped. Found by static analysis. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89475.json">CVE-2026-89475</a> Added Reference https://git.kernel.org/stable/c/47ccbad210f48721c30d69d65b83dc9fff919ca9 Added Reference https://git.kernel.org/stable/c/861ec73ce86e2ca18082cc7be4f140a5bbdf1428 Added Reference https://git.kernel.org/stable/c/9d34c9d660c3d0931d2cc749c46c47cf31f96e48 Added Reference https://git.kernel.org/stable/c/f495808cdd6d9576965787cf6d9737d0b0e86b73