CVE-2026-89469 - Vulnerability Details

- power: supply: lp8727: fix use-after-free in lp8727_release_irq()

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: lp8727: fix use-after-free in lp8727_release_irq()

lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms
pchg->work via schedule_delayed_work(). lp8727_release_irq() currently
cancels the work before freeing the IRQ, so an IRQ delivered in between
can re-arm the work through the threaded handler. After .remove returns
the devm layer frees pchg while lp8727_delayed_func() may still run and
dereference it.

Free the IRQ first so the threaded handler is quiesced and can no longer
queue work, then cancel the delayed work to drain the final generation.

This issue was found by an in-house static analysis tool.

Published: 2026-09-11

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free flaw in the Linux kernel’s LP8727 power‑supply driver allows a delayed work task to be scheduled after the driver has released the IRQ and freed‑arm the work, and when the device is removed, the work may run on a freed pointer, potentially crashing the kernel or corrupting memory. The flaw represents a classic CWE‑825 scenario that exposes the kernel to arbitrary memory corruption from privileged driver code.

Affected Systems

Any installation of the Linux kernel that includes the LP8727 power‑supply driver utilizes commit 6ab3128292df67295de1b2a86f21d89cf6612a7e. The driver is used on systems equipped with the LP8727 power‑management chip, and no specific kernel version information is available for impacted kernels.

Risk and Exploitability

The CVSS score of 8.4 denotes high severity. EPSS remains < 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be local privilege or a maliciously constructed interrupt. Successful exploitation could lead to kernel crashes, memory corruption, or privilege escalation. However, achieving a successful attack would require a crafted interrupt or manipulation of the LP8727 device, which is unlikely in normal operation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d71fda01610269e3aaedd451f8d3e34cdf550036`	affected	< 1321a4e6247164312eabc6d07f88572da2ee308c
`d71fda01610269e3aaedd451f8d3e34cdf550036`	affected	< dc1dc2837f8e53bde2f16d52a63f4142e21757f1
`d71fda01610269e3aaedd451f8d3e34cdf550036`	affected	< 035cc6bc4d412dd4302862e8f859b784fcd4653b
`d71fda01610269e3aaedd451f8d3e34cdf550036`	affected	< 6f0ce09d60a0e4fab6f9ebe8294750481f0c19dd
`d71fda01610269e3aaedd451f8d3e34cdf550036`	affected	< 80d4e40a85ba524e66c8c748aa7bb19eaf2f69df
`d71fda01610269e3aaedd451f8d3e34cdf550036`	affected	< ab6b1ad710bed7931540733ce145493fece8ceef
`d71fda01610269e3aaedd451f8d3e34cdf550036`	affected	< 6ab3128292df67295de1b2a86f21d89cf6612a7e
`d71fda01610269e3aaedd451f8d3e34cdf550036`	affected	< ceb6ac43b0f591722401922ceb958ce2616935e0

Linux

affected

Version	Status	Constraints
`3.7`	affected	—
`0`	unaffected	< 3.7
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d71fda01610269e3aaedd451f8d3e34cdf550036,80d4e40a85ba524e66c8c748aa7bb19eaf2f69df)`	affected	code_commit	—
`[d71fda01610269e3aaedd451f8d3e34cdf550036,ab6b1ad710bed7931540733ce145493fece8ceef)`	affected	code_commit	—
`[d71fda01610269e3aaedd451f8d3e34cdf550036,6ab3128292df67295de1b2a86f21d89cf6612a7e)`	affected	code_commit	—
`[d71fda01610269e3aaedd451f8d3e34cdf550036,ceb6ac43b0f591722401922ceb958ce2616935e0)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.7`	affected	generic	—
`[0,3.7)`	unaffected	generic	—
`[6.12.109,7.0.0]`	unaffected	semver	—
`[6.18.50,6.19.0]`	unaffected	semver	—
`[7.2.4,7.3.0]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel release or update that includes commit 6ab3128292df67295de1b2a86f21d89cf6612a7e or later, which reorders IRQ release and work cancellation.
Backport the changes from commit 6ab3128292df67295de1b2a86f21d89cf6612a7e to your current kernel source, then rebuild and install the updated kernel.
Unload or disable the LP8727 driver or block its IRQ from the system until the patched kernel is deployed.

Generated by OpenCVE AI on September 15, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0019.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/035cc6bc4d412dd4302862e8f859b784fcd4653b
https://git.kernel.org/stable/c/1321a4e6247164312eabc6d07f88572da2ee308c
https://git.kernel.org/stable/c/6ab3128292df67295de1b2a86f21d89cf6612a7e
https://git.kernel.org/stable/c/6f0ce09d60a0e4fab6f9ebe8294750481f0c19dd
https://git.kernel.org/stable/c/80d4e40a85ba524e66c8c748aa7bb19eaf2f69df
https://git.kernel.org/stable/c/ab6b1ad710bed7931540733ce145493fece8ceef
https://git.kernel.org/stable/c/ceb6ac43b0f591722401922ceb958ce2616935e0
https://git.kernel.org/stable/c/dc1dc2837f8e53bde2f16d52a63f4142e21757f1
https://nvd.nist.gov/vuln/detail/CVE-2026-89469
https://www.cve.org/CVERecord?id=CVE-2026-89469

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/035cc6bc4d412dd4302862e8f859b784fcd4653b https://git.kernel.org/stable/c/1321a4e6247164312eabc6d07f88572da2ee308c https://git.kernel.org/stable/c/6f0ce09d60a0e4fab6f9ebe8294750481f0c19dd https://git.kernel.org/stable/c/dc1dc2837f8e53bde2f16d52a63f4142e21757f1

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89469 https://www.cve.org/CVERecord?id=CVE-2026-89469
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg->work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it. Free the IRQ first so the threaded handler is quiesced and can no longer queue work, then cancel the delayed work to drain the final generation. This issue was found by an in-house static analysis tool.
Title		power: supply: lp8727: fix use-after-free in lp8727_release_irq()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6ab3128292df67295de1b2a86f21d89cf6612a7e https://git.kernel.org/stable/c/80d4e40a85ba524e66c8c748aa7bb19eaf2f69df https://git.kernel.org/stable/c/ab6b1ad710bed7931540733ce145493fece8ceef https://git.kernel.org/stable/c/ceb6ac43b0f591722401922ceb958ce2616935e0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:28.560Z

Updated: 2026-09-14T12:00:06.392Z

Reserved: 2026-09-11T19:38:34.709Z

Link: CVE-2026-89469

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:28.023

Modified: 2026-09-14T13:19:03.157

Link: CVE-2026-89469

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:28Z

Links: CVE-2026-89469 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T23:00:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object