Executive brief
The Linux kernel's LP8788 charger driver contains a use-after-free vulnerability in its device removal code. When the charger device is removed, a race condition can cause a worker thread to dereference freed memory, potentially leading to a kernel crash or instability. This affects systems using LP8788 charger hardware.
Technical details
The vulnerability is a use-after-free race condition in lp8788_charger_remove(). The function previously called flush_work() before unregistering IRQs, allowing an IRQ thread to queue charger_work after the flush returns. The queued work could then execute after devres freed the pchg structure, causing a dereference of freed memory in lp8788_charger_event(). The fix reorders operations: first unregister IRQs via free_irq() (which waits for running handlers), then use cancel_work_sync() to cancel pending or running work. This prevents any IRQ handler from queuing work after IRQ unregistration. The fix is available and has been backported to stable kernel branches.
Affected products
- Linux Linux kernel affected versions from introduction of lp8788 driver (kernel 3.5+) through the fix in August 2026
Timeline
- 2026-09-11: disclosed: CVE-2026-89468 published
- 2026-08-04: patched: Fix committed upstream by Sebastian Reichel
- 2026-08-02: other: Fix authored by Fan Wu