CVE-2026-89465 - Vulnerability Details

- power: supply: rt9455: quiesce delayed work before teardown

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: rt9455: quiesce delayed work before teardown

The threaded IRQ handler can queue pwr_rdy_work,
max_charging_time_work and batt_presence_work. pwr_rdy_work and
batt_presence_work can also queue max_charging_time_work, while
batt_presence_work can requeue itself.

rt9455_remove() cancels max_charging_time_work before
batt_presence_work. The latter can therefore queue
max_charging_time_work after it has already been cancelled:

rt9455_remove() workqueue
cancel pwr_rdy_work
cancel max_charging_time_work
batt_presence_work queues
max_charging_time_work
cancel batt_presence_work
return
devres frees rt9455_info
max_charging_time_work dereferences
rt9455_info

The IRQ also remains registered until devres cleanup and can queue more
work after any of the cancellation calls. If rt9455_hw_init() fails
after the IRQ has been requested, probe returns without cancelling work
that may already have been queued. A pending callback can then access
rt9455_info after it has been freed.

Register rt9455_cancel_all_delayed_works() through
devm_add_action_or_reset() right after devm_power_supply_register().
devres invokes the action in reverse registration order, after the
managed IRQ has been freed and before rt9455_info is released, so the
delayed works are drained in both rt9455_remove() and the probe error
path. Cancel pwr_rdy_work and batt_presence_work before
max_charging_time_work because both can queue the latter.

This issue was found by an in-house static analysis tool.

Published: 2026-09-11

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The rt9455 power-supply driver removal or a probe failure, some of those work items are not cancelled in the required order. Consequently, a queued work function can execute after the driver’s data structure has already been freed, causing an use-after-free that leads to a kernel crash. The flaw is identified as CWE‑825.

Affected Systems

Any Linux kernel configuration that includes the rt9455 driver is vulnerable; the affected builds are all those produced before the patch that implements the correct cancellation sequence. The vendor list shows the driver belongs to Linux:Linux, so the issue spans the mainline kernel and all distributions that ship it unmodified.

Risk and Exploitability

The CVSS score of 8.4 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, implying no public exploitation activity has been observed. The likely attack vector requires local access to interfere with the device – for example, triggering a removal or a probe-failure path – because the vulnerability is tied to kernel driver internals and is not exposed through user-space interfaces.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< 442c60c08ec23ac45da0a58877cab05e0a58f4ea
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< 1b9978433c61a9b46e48832a1ebceee1cf5c9eb4
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< 7323e562f6961e4b7bce3225cde4ecbc78260deb
`e86d69dd786e94046b8f5be7df1b9a8226a40b2a`	affected	< 3e7a1ebc32fad5a558254a478efd401c17a24381

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,1b9978433c61a9b46e48832a1ebceee1cf5c9eb4)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,7323e562f6961e4b7bce3225cde4ecbc78260deb)`	affected	code_commit	—
`[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,3e7a1ebc32fad5a558254a478efd401c17a24381)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version containing applied, disable the rt9455 power-supply driver (e.g., by removing the module or disabling the device in the kernel configuration) to avoid removal or probe-failure scenarios.
Monitor kernel logs for rt9455-related workqueue errors or crashes, and apply the patch as soon as it becomes available.
If an immediate kernel upgrade is not possible, use a udev rule to block hotplug removal of the rt9455 device until the patch is deployed.

Generated by OpenCVE AI on September 21, 2026 at 01:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00196.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1b9978433c61a9b46e48832a1ebceee1cf5c9eb4
https://git.kernel.org/stable/c/3e7a1ebc32fad5a558254a478efd401c17a24381
https://git.kernel.org/stable/c/442c60c08ec23ac45da0a58877cab05e0a58f4ea
https://git.kernel.org/stable/c/7323e562f6961e4b7bce3225cde4ecbc78260deb
https://git.kernel.org/stable/c/df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02
https://nvd.nist.gov/vuln/detail/CVE-2026-89465
https://www.cve.org/CVERecord?id=CVE-2026-89465

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/442c60c08ec23ac45da0a58877cab05e0a58f4ea

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89465 https://www.cve.org/CVERecord?id=CVE-2026-89465
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_work and batt_presence_work can also queue max_charging_time_work, while batt_presence_work can requeue itself. rt9455_remove() cancels max_charging_time_work before batt_presence_work. The latter can therefore queue max_charging_time_work after it has already been cancelled: rt9455_remove() workqueue cancel pwr_rdy_work cancel max_charging_time_work batt_presence_work queues max_charging_time_work cancel batt_presence_work return devres frees rt9455_info max_charging_time_work dereferences rt9455_info The IRQ also remains registered until devres cleanup and can queue more work after any of the cancellation calls. If rt9455_hw_init() fails after the IRQ has been requested, probe returns without cancelling work that may already have been queued. A pending callback can then access rt9455_info after it has been freed. Register rt9455_cancel_all_delayed_works() through devm_add_action_or_reset() right after devm_power_supply_register(). devres invokes the action in reverse registration order, after the managed IRQ has been freed and before rt9455_info is released, so the delayed works are drained in both rt9455_remove() and the probe error path. Cancel pwr_rdy_work and batt_presence_work before max_charging_time_work because both can queue the latter. This issue was found by an in-house static analysis tool.
Title		power: supply: rt9455: quiesce delayed work before teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1b9978433c61a9b46e48832a1ebceee1cf5c9eb4 https://git.kernel.org/stable/c/3e7a1ebc32fad5a558254a478efd401c17a24381 https://git.kernel.org/stable/c/7323e562f6961e4b7bce3225cde4ecbc78260deb https://git.kernel.org/stable/c/df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:25.950Z

Updated: 2026-09-14T12:00:04.241Z

Reserved: 2026-09-11T19:38:34.709Z

Link: CVE-2026-89465

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:27.533

Modified: 2026-09-14T13:19:02.870

Link: CVE-2026-89465

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:25Z

Links: CVE-2026-89465 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T01:15:03Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object