Executive brief
The bq256xx battery charger driver in the Linux kernel contains a use-after-free vulnerability where a USB work queue handler can access freed memory during device cleanup. This could lead to kernel crashes or unexpected behavior when the charger device is removed, affecting system stability on devices using this power management driver.
Technical details
The vulnerability is a use-after-free in the bq256xx charger driver's USB-PHY notifier handling. The USB-PHY notifier queues work (usb_work) whose handler calls power_supply_changed(), but the devm reset action—which unregisters the notifier and drains the work queue—was registered before the power supplies are initialized. This causes the power supplies to be freed before the notifier is unregistered, leaving queued work to dereference freed memory. The fix moves the reset action registration to after power supply initialization and initializes the work queue before registering notifiers, ensuring proper cleanup order and preventing the worker from running before required structures exist. This issue was found through static analysis and affects the bq256xx charger driver across multiple kernel versions.
Affected products
- Linux Linux kernel Affected versions include bq256xx charger driver introduced in 32e4978bb920 and subsequent kernel releases (5.x through 7.x series based on available patches)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-08-04: patched: Patch committed upstream (2dd6cd82)
- 2026-09-14: other: Patch merged to stable tree (2cfb59dc)