CVE-2026-89468 - Vulnerability Details

- power: supply: lp8788-charger: fix use-after-free on remove

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: lp8788-charger: fix use-after-free on remove

lp8788_charger_remove() flushes charger_work before unregistering the
IRQs. An IRQ thread can queue charger_work after flush_work() has
returned. The work can then run after devres frees pchg and dereference
it in lp8788_charger_event().

Unregister the IRQs first. free_irq() waits for any running threaded
handler, so no handler can queue more work afterwards. Then use
cancel_work_sync() to cancel pending work or wait for running work to
finish.

This issue was found by an in-house static analysis tool.

Published: 2026-09-11

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An improper ordering of work queue flushing and IRQ unregistration in the lp8788 charger driver causes a use‑after‑free when the device is removed. The driver flushes pending work too early and then cancels the IRQs afterwards, allowing a worker thread scheduled after the flush to dereference freed memory. This flaw falls under CWE‑364 and can materialize as a kernel panic or other system instability. Attackers would need privileged or local access to trigger the removal sequence.

Affected Systems

All Linux kernel builds that include the lp8788 charger module are potentially affected. No exact kernel release numbers are specified, so any kernel that compiles the driver without the patch carries the risk.

Risk and Exploitability

The CVSS score of 4.1 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The flaw requires the device to be removed or the driver unloaded, which is typically a local or privileged action; remote exploitation is not implied. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`98a2766493589c18c327ae3dad5243b53fcb5f70`	affected	< 88d8eadfad5d9ff967e74090152940bcfa27df69
`98a2766493589c18c327ae3dad5243b53fcb5f70`	affected	< b3aa1e9509e1b0a863353356d617fb45d1b6250a
`98a2766493589c18c327ae3dad5243b53fcb5f70`	affected	< b4eb6a056b441ba0caedfbfc42cec501acf12f67
`98a2766493589c18c327ae3dad5243b53fcb5f70`	affected	< 831c29a12d560f8a3225f43050b3fbb5dfd79c66

Linux

affected

Version	Status	Constraints
`3.7`	affected	—
`0`	unaffected	< 3.7
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[98a2766493589c18c327ae3dad5243b53fcb5f70,88d8eadfad5d9ff967e74090152940bcfa27df69)`	affected	code_commit	—
`[98a2766493589c18c327ae3dad5243b53fcb5f70,b3aa1e9509e1b0a863353356d617fb45d1b6250a)`	affected	code_commit	—
`[98a2766493589c18c327ae3dad5243b53fcb5f70,b4eb6a056b441ba0caedfbfc42cec501acf12f67)`	affected	code_commit	—
`[98a2766493589c18c327ae3dad5243b53fcb5f70,831c29a12d560f8a3225f43050b3fbb5dfd79c66)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.7`	affected	generic	—
`[0,3.7)`	unaffected	generic	—
`[6.12.109,7.0.0)`	unaffected	semver	—
`[6.18.50,7.0.0)`	unaffected	semver	—
`[7.2.4,8.0.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a kernel version that incorporates the patch in which interrupts are unregistered before work is flushed and cancel_work_sync is used to prevent dangling work registrations.
If a kernel upgrade cannot be applied immediately, avoid unloading or removing the lp8788 charger module during normal operation; for example, disable hot‑plug removal for that device or lock the module in memory.
Ensure that the charger hardware is fully powered off before the driver is removed, such as by following the board’s shutdown sequence or disabling power management events that trigger controller removal.

Generated by OpenCVE AI on September 21, 2026 at 01:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/831c29a12d560f8a3225f43050b3fbb5dfd79c66
https://git.kernel.org/stable/c/88d8eadfad5d9ff967e74090152940bcfa27df69
https://git.kernel.org/stable/c/b3aa1e9509e1b0a863353356d617fb45d1b6250a
https://git.kernel.org/stable/c/b4eb6a056b441ba0caedfbfc42cec501acf12f67
https://nvd.nist.gov/vuln/detail/CVE-2026-89468
https://www.cve.org/CVERecord?id=CVE-2026-89468

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89468 https://www.cve.org/CVERecord?id=CVE-2026-89468
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788_charger_remove() flushes charger_work before unregistering the IRQs. An IRQ thread can queue charger_work after flush_work() has returned. The work can then run after devres frees pchg and dereference it in lp8788_charger_event(). Unregister the IRQs first. free_irq() waits for any running threaded handler, so no handler can queue more work afterwards. Then use cancel_work_sync() to cancel pending work or wait for running work to finish. This issue was found by an in-house static analysis tool.
Title		power: supply: lp8788-charger: fix use-after-free on remove
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/831c29a12d560f8a3225f43050b3fbb5dfd79c66 https://git.kernel.org/stable/c/88d8eadfad5d9ff967e74090152940bcfa27df69 https://git.kernel.org/stable/c/b3aa1e9509e1b0a863353356d617fb45d1b6250a https://git.kernel.org/stable/c/b4eb6a056b441ba0caedfbfc42cec501acf12f67

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:27.906Z

Updated: 2026-09-11T19:43:27.906Z

Reserved: 2026-09-11T19:38:34.709Z

Link: CVE-2026-89468

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:27.910

Modified: 2026-09-11T20:19:27.910

Link: CVE-2026-89468

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:27Z

Links: CVE-2026-89468 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T01:30:08Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object