CVE-2026-89464 - Vulnerability Details

- power: supply: twl4030_charger: cancel workers via devm

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: twl4030_charger: cancel workers via devm

bci is devm-allocated. Two workers (bci->work and bci->current_worker)
dereference it. twl4030_bci_remove() disables charging and masks
interrupts. It cancels neither worker. A worker pending at remove() can
run after devm frees bci.

The USB transceiver comes from devm_usb_get_phy_by_node(). devm
unregisters its notifier only after remove() returns. A cancel_work_sync()
in remove() can then race a notifier reschedule. devm_work_autocancel()
and devm_delayed_work_autocancel() avoid that. They cancel the workers
during devm release, before bci is freed.

The current_worker is registered first, since devm will cancel in
reverse order and bci->work can reschedule current_worker.

[Move comment about order into the commit message]

Published: 2026-09-11

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux twl4030 charger driver allows workers that run after the driver’s resources have been released to dereference a freed structure allocated by devm, leading to a use‑after‑free that can cause the kernel to crash.

Affected Systems

The vulnerability affects any Linux kernel that still contains the unpatched twl4030 charger driver code. All distributions with kernel builds that have not incorporated the upstream patch that cancels both workers before freeing the devm object remain vulnerable. The specific kernel releases are not listed in the advisory, but any version where the driver code is unchanged is impacted.

Risk and Exploitability

The CVSS base score of 4.4 indicates moderate severity, while the EPSS probability of exploitation is very low. The issue requires local control over the device removal to trigger the race, making it unlikely to be exploited remotely or by an unauthenticated attacker. The vulnerability is not listed in CISA’s KEV catalog, indicating no known exploitation activity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d6ccc442b12102414c1343f0adacaa8a1aaa516c`	affected	< 9644c96ef8646c65d46caa5139a6631e29b79d6c
`d6ccc442b12102414c1343f0adacaa8a1aaa516c`	affected	< e9fffe10bd791082263c1678f2f6cdd6d7b487e0
`d6ccc442b12102414c1343f0adacaa8a1aaa516c`	affected	< c46c205bab0dfce4dd54aeb49da3f183e1fdfc63
`d6ccc442b12102414c1343f0adacaa8a1aaa516c`	affected	< 72a2d6cd049f892853e4e2d8d8fc5e7d0244a458
`d6ccc442b12102414c1343f0adacaa8a1aaa516c`	affected	< a4460e89d4088cfec2da5be33e265ef1a8e780e9
`d6ccc442b12102414c1343f0adacaa8a1aaa516c`	affected	< b955da82db4170bdf1c784dc457287aa0c977378
`d6ccc442b12102414c1343f0adacaa8a1aaa516c`	affected	< 6eba34732524067da2aad5ddfdfbc641ded10e9e

Linux

affected

Version	Status	Constraints
`2.6.39`	affected	—
`0`	unaffected	< 2.6.39
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d6ccc442b12102414c1343f0adacaa8a1aaa516c,72a2d6cd049f892853e4e2d8d8fc5e7d0244a458)`	affected	code_commit	—
`[d6ccc442b12102414c1343f0adacaa8a1aaa516c,a4460e89d4088cfec2da5be33e265ef1a8e780e9)`	affected	code_commit	—
`[d6ccc442b12102414c1343f0adacaa8a1aaa516c,b955da82db4170bdf1c784dc457287aa0c977378)`	affected	code_commit	—
`[d6ccc442b12102414c1343f0adacaa8a1aaa516c,6eba34732524067da2aad5ddfdfbc641ded10e9e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.39`	affected	semver	—
`[0,2.6.39)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a kernel that includes the fix for the twl4030 charger driver, which removes both work queues before freeing the devm object.
If a kernel upgrade is not immediately feasible, apply the specific commit that corrects the cancellation logic to the driver source or cherry‑pick it into the running kernel.
Disable or unload the twl4030 charger driver at boot or once the device is no longer needed to prevent the race condition from occurring.

Generated by OpenCVE AI on September 21, 2026 at 01:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/6eba34732524067da2aad5ddfdfbc641ded10e9e
https://git.kernel.org/stable/c/72a2d6cd049f892853e4e2d8d8fc5e7d0244a458
https://git.kernel.org/stable/c/9644c96ef8646c65d46caa5139a6631e29b79d6c
https://git.kernel.org/stable/c/a4460e89d4088cfec2da5be33e265ef1a8e780e9
https://git.kernel.org/stable/c/b955da82db4170bdf1c784dc457287aa0c977378
https://git.kernel.org/stable/c/c46c205bab0dfce4dd54aeb49da3f183e1fdfc63
https://git.kernel.org/stable/c/e9fffe10bd791082263c1678f2f6cdd6d7b487e0
https://nvd.nist.gov/vuln/detail/CVE-2026-89464
https://www.cve.org/CVERecord?id=CVE-2026-89464

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/9644c96ef8646c65d46caa5139a6631e29b79d6c https://git.kernel.org/stable/c/c46c205bab0dfce4dd54aeb49da3f183e1fdfc63 https://git.kernel.org/stable/c/e9fffe10bd791082263c1678f2f6cdd6d7b487e0

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89464 https://www.cve.org/CVERecord?id=CVE-2026-89464
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030_charger: cancel workers via devm bci is devm-allocated. Two workers (bci->work and bci->current_worker) dereference it. twl4030_bci_remove() disables charging and masks interrupts. It cancels neither worker. A worker pending at remove() can run after devm frees bci. The USB transceiver comes from devm_usb_get_phy_by_node(). devm unregisters its notifier only after remove() returns. A cancel_work_sync() in remove() can then race a notifier reschedule. devm_work_autocancel() and devm_delayed_work_autocancel() avoid that. They cancel the workers during devm release, before bci is freed. The current_worker is registered first, since devm will cancel in reverse order and bci->work can reschedule current_worker. [Move comment about order into the commit message]
Title		power: supply: twl4030_charger: cancel workers via devm
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6eba34732524067da2aad5ddfdfbc641ded10e9e https://git.kernel.org/stable/c/72a2d6cd049f892853e4e2d8d8fc5e7d0244a458 https://git.kernel.org/stable/c/a4460e89d4088cfec2da5be33e265ef1a8e780e9 https://git.kernel.org/stable/c/b955da82db4170bdf1c784dc457287aa0c977378

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:25.282Z

Updated: 2026-09-14T12:00:03.171Z

Reserved: 2026-09-11T19:38:34.708Z

Link: CVE-2026-89464

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:27.410

Modified: 2026-09-14T13:19:02.747

Link: CVE-2026-89464

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:25Z

Links: CVE-2026-89464 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T01:15:03Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object