Description
In the Linux kernel, the following vulnerability has been resolved:

power: supply: bq256xx: drain usb_work before freeing the charger

The USB-PHY notifier queues usb_work, whose handler calls
power_supply_changed(bq->charger). The reset devm action only unregisters
the notifier and was registered before the power supplies, so devm frees
bq->charger on unwind before the action runs; a usb_work still queued can
then dereference it.

Register the reset action after the power supplies, so it unregisters
the notifiers and drains usb_work before the supplies are released.
Initialize usb_work and obtain the PHY references before registering
the notifiers, so the worker cannot run before the supplies exist.

Found by static analysis.
Published: 2026-09-11
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use-After-Free (Local Privilege Escalation / Denial of Service)
Action: Patch Kernel
AI Analysis

Impact

The bug is a use‑after‑free in the Linux kernel’s bq256xx power‑supply driver. A usb_work worker retains a reference to a charger object that is freed by a reset action before the worker’s handler can run. When the worker dereferences the freed object, the kernel can panic, and under certain conditions a local attacker who can trigger the race may gain elevated privileges. The CVSS score of 4.4 indicates moderate severity for a local flaw.

Affected Systems

All Linux kernel installations that include the bq256xx power‑supply driver before the patch. The official CPE indicates all kernel builds; the exact version range is not listed, but any kernel that registers the notifier and reset action in the legacy order is impacted.

Risk and Exploitability

The EPSS score is less than 1 %, implying a low probability of exploitation in the wild. The vulnerability is local and requires active manipulation of USB power events; no public exploit has been disclosed and it is not listed in the CISA KEV catalog. With a CVSS of 4.4 the risk is moderate, and remediation through patching is the recommended path.

Generated by OpenCVE AI on September 12, 2026 at 18:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the kernel to a build containing the fix that registers the reset action after the power supplies, drains usb_work before freeing supplies, and initializes usb_work prior to notifier registration.
  • Reboot the system to load the updated kernel and apply the new driver logic.
  • If an immediate kernel update is not possible, disable the bq256xx driver or ensure no USB devices are connected until the kernel is updated to prevent usb_work scheduling during reset.

Generated by OpenCVE AI on September 12, 2026 at 18:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sat, 12 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sat, 12 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb_work before freeing the charger The USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq->charger). The reset devm action only unregisters the notifier and was registered before the power supplies, so devm frees bq->charger on unwind before the action runs; a usb_work still queued can then dereference it. Register the reset action after the power supplies, so it unregisters the notifiers and drains usb_work before the supplies are released. Initialize usb_work and obtain the PHY references before registering the notifiers, so the worker cannot run before the supplies exist. Found by static analysis.
Title power: supply: bq256xx: drain usb_work before freeing the charger
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:43:31.882Z

Reserved: 2026-09-11T19:38:34.710Z

Link: CVE-2026-89474

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:28.687

Modified: 2026-09-11T20:19:28.687

Link: CVE-2026-89474

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:31Z

Links: CVE-2026-89474 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-12T19:00:08Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference