CVE-2026-89463: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89463 Overview

CVE-2026-89463 is a use-after-free vulnerability in the Linux kernel's ucs1002 power supply driver. The driver lacks a dedicated remove callback, so unbind operations run entirely through the device-managed (devm) resource framework. The alert IRQ handler queues a health_poll delayed work item that reschedules itself while the chip reports a bad-health condition. When devm frees the alert IRQ, it only synchronizes the handler; it does not cancel the delayed work. The work can then execute after devm frees the driver data and dereference the freed memory. The issue was identified by an in-house static analysis tool and resolved upstream.

Critical Impact
A local trigger during driver unbind can cause the kernel to dereference freed memory, leading to memory corruption or a kernel crash on systems using the ucs1002 USB port controller driver.

Affected Products

Linux kernel with the power: supply: ucs1002 driver compiled in or as a module
Stable kernel branches referenced by the seven backport commits linked in the advisory
Embedded and ARM-based platforms using the Microchip UCS1002 USB port power controller

Discovery Timeline

2026-09-11 - CVE-2026-89463 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89463

Vulnerability Analysis

The ucs1002 driver manages a USB port power controller and relies on the devm framework for all resource lifecycle management. Because no explicit remove callback exists, unbind teardown iterates the devres list in reverse allocation order. The driver registers an alert IRQ whose handler calls schedule_delayed_work() on a health_poll work item, and the work function reschedules itself whenever the chip reports a bad-health state.

During unbind, devm releases the IRQ using free_irq(), which synchronizes any in-flight handler execution but does not cancel pending or queued delayed work. The driver-private data is subsequently freed by another devm release action. If the delayed work fires after this point, it dereferences the already-freed driver context, producing a classic use-after-free condition.

Root Cause

The root cause is an ordering mismatch between resource release actions in devm. The delayed work was not registered as a managed resource with automatic cancellation, so its lifetime was not bound to the driver data. The IRQ handler could requeue the work up to the moment free_irq() returned, and the work could then run against freed memory.

Attack Vector

Triggering the flaw requires the driver to be bound to hardware and then unbound while the chip reports a bad-health condition that causes health_poll to reschedule itself. On affected systems, an unprivileged trigger path is generally not available; the local root or physical hardware conditions required limit real-world exploitability. The primary impact is kernel memory corruption or a denial of service through kernel oops.

The fix registers health_poll with devm_delayed_work_autocancel() before requesting the alert IRQ. This reorders release so devm frees the IRQ first, preventing the handler from queuing new work, then cancels the delayed work before the driver data is freed. See the upstream commits 00c19f8, 2ec4d20, 35242c9, 39b60d6, 4ca2a46, 609af0c, and a9a7bb8 for details.

Detection Methods for CVE-2026-89463

Indicators of Compromise

Kernel oops or panic traces referencing ucs1002, health_poll, or delayed work execution after driver unbind
KASAN reports flagging use-after-free reads in the ucs1002 module context
Unexpected reboots or lockups on platforms integrating the Microchip UCS1002 controller

Detection Strategies

Enable KASAN and lockdep on test kernels to surface the use-after-free during driver bind/unbind stress cycles
Audit loaded kernel modules with lsmod | grep ucs1002 and correlate module version against patched stable releases
Compare running kernel version and vendor build against the upstream commit hashes listed in the advisory

Monitoring Recommendations

Ingest dmesg and journalctl -k output into a centralized log store and alert on BUG:, KASAN, and Oops strings tied to power supply subsystems
Track driver bind and unbind events through udev logs on embedded fleets that ship the UCS1002 controller
Monitor unplanned reboots on Linux edge and IoT devices where the driver is present

How to Mitigate CVE-2026-89463

Immediate Actions Required

Upgrade to a Linux kernel release that includes one of the seven referenced stable commits
For embedded and IoT vendors, rebuild firmware images with the patched kernel and push updates to affected devices
Restrict physical access and administrative unbind privileges on systems where patching is deferred

Patch Information

The upstream fix registers the health_poll delayed work with devm_delayed_work_autocancel() before the alert IRQ is requested. This guarantees that devm frees the IRQ first, blocking further queue operations, and cancels the outstanding delayed work before releasing the driver-private data. Apply any of the stable backports referenced above that match your kernel branch.

Workarounds

Blacklist the ucs1002 module on systems that do not require USB port power control: add blacklist ucs1002 to /etc/modprobe.d/
Avoid manual unbind operations on the ucs1002 sysfs device on unpatched kernels
Where possible, disable CONFIG_CHARGER_UCS1002 in custom kernel builds until patched sources are deployed

bash

# Verify running kernel and check for the ucs1002 module
uname -r
lsmod | grep ucs1002

# Prevent the vulnerable driver from loading on unpatched systems
echo 'blacklist ucs1002' | sudo tee /etc/modprobe.d/cve-2026-89463.conf
sudo update-initramfs -u