Executive brief
The Linux kernel's twl4030_charger power supply driver manages battery charging and USB connectivity. A flaw in device removal could allow worker threads to access memory after it has been freed, potentially causing system crashes or undefined behavior. The issue occurs when the driver is unloaded or a device is removed while background tasks are still pending.
Technical details
The vulnerability is a use-after-free flaw in the twl4030_charger driver's cleanup logic. The bci structure is allocated with devm (device-managed memory), but two worker threads (bci->work and bci->current_worker) were not properly registered with the devm lifecycle management. During device removal, workers could be rescheduled by USB notifier callbacks after devm freed the bci structure, leading to dereferencing of freed memory. The fix uses devm_work_autocancel() and devm_delayed_work_autocancel() to ensure workers are properly cancelled during the devm cleanup phase, before the bci structure is freed. No network attack vector exists; this requires a local device removal or driver unload scenario.
Affected products
- Linux Linux kernel multiple versions before the fix commit 6eba34732524067da2aad5ddfdfbc641ded10e9e
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-07-25: patched: Fix committed upstream (commit 6eba34732524067da2aad5ddfdfbc641ded10e9e)