Executive brief
The Linux kernel's lp8727 charger driver contains a use-after-free vulnerability in its IRQ cleanup routine. When the charger device is removed, a race condition allows a delayed work function to access freed memory, potentially causing a system crash or enabling code execution. This affects systems using LP8727 charger controllers for power management.
Technical details
This is a use-after-free vulnerability in the lp8727_release_irq() function within the Linux kernel power supply subsystem. The root cause is a race condition: the function previously cancelled delayed work before freeing the IRQ handler, allowing a threaded IRQ (lp8727_isr_func) arriving in that window to re-arm the work queue. After device removal, the devm layer frees the driver data structure while the delayed work function (lp8727_delayed_func) may still be queued and attempt to dereference it. The fix reorders operations to free the IRQ first (quiescing the handler), then cancel any remaining delayed work. The vulnerability requires the device to be actively handling interrupts during removal. A patch has been released and backported to stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions prior to patch (commit ceb6ac43b0f591722401922ceb958ce2616935e0)
Timeline
- 2026-09-11: disclosed: CVE-2026-89469 published
- 2026-09-14: patched: Patch backported to stable kernel branches by Greg Kroah-Hartman