Executive brief
The Linux kernel's bq24257 battery charger driver contains a use-after-free vulnerability during device removal. A deferred work routine can be rescheduled by an interrupt handler after the device memory is freed, causing the work to execute against freed memory and potentially leading to kernel crashes or undefined behavior.
Technical details
This is a use-after-free vulnerability in the bq24257 power supply charger driver. The STAT-pin interrupt is device-managed (devm), remaining armed after remove() is called. The remove() function cancels bq->iilimit_setup_work, but the threaded interrupt handler can still fire and reschedule the work, causing it to dereference freed device memory once devm cleanup completes. The fix registers the delayed work as device-managed with devm_delayed_work_autocancel() before the interrupt request, ensuring devm cleanup releases the interrupt first (preventing handler rescheduling) and cancels the work before memory is freed. Found through static analysis; no evidence of in-the-wild exploitation.
Affected products
- Linux Linux kernel multiple versions (see stable branches linux-4.x through linux-7.x)
Timeline
- 2026-09-11: disclosed: CVE-2026-89475 published
- 2026-08-01: patched: Upstream fix by Fan Wu
- 2026-09-07: patched: Stable tree backport