CVE-2026-89464
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
power: supply: twl4030_charger: cancel workers via devm
In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030_charger: cancel workers via devm bci is devm-allocated. Two workers (bci->work and bci->current_worker) dereference it. twl4030_bci_remove() disables charging and masks interrupts. It cancels neither worker. A worker pending at remove() can run after devm frees bci. The USB transceiver comes from devm_usb_get_phy_by_node(). devm unregisters its notifier only after remove() returns. A cancel_work_sync() in remove() can then race a notifier reschedule. devm_work_autocancel() and devm_delayed_work_autocancel() avoid that. They cancel the workers during devm release, before bci is freed. The current_worker is registered first, since devm will cancel in reverse order and bci->work can reschedule current_worker. [Move comment about order into the commit message]
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| d6ccc442b12102414c1343f0adacaa8a1aaa516c | affected | git | 9644c96ef8646c65d46caa5139a6631e29b79d6c | Unavailable | None listed |
| d6ccc442b12102414c1343f0adacaa8a1aaa516c | affected | git | e9fffe10bd791082263c1678f2f6cdd6d7b487e0 | Unavailable | None listed |
| d6ccc442b12102414c1343f0adacaa8a1aaa516c | affected | git | c46c205bab0dfce4dd54aeb49da3f183e1fdfc63 | Unavailable | None listed |
| d6ccc442b12102414c1343f0adacaa8a1aaa516c | affected | git | 72a2d6cd049f892853e4e2d8d8fc5e7d0244a458 | Unavailable | None listed |
| d6ccc442b12102414c1343f0adacaa8a1aaa516c | affected | git | a4460e89d4088cfec2da5be33e265ef1a8e780e9 | Unavailable | None listed |
| d6ccc442b12102414c1343f0adacaa8a1aaa516c | affected | git | b955da82db4170bdf1c784dc457287aa0c977378 | Unavailable | None listed |
| d6ccc442b12102414c1343f0adacaa8a1aaa516c | affected | git | 6eba34732524067da2aad5ddfdfbc641ded10e9e | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.6.39 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 2.6.39 | Unavailable | None listed |
| 5.15.221 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.188 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.157 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.109 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.50 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.4 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |