CVE-2026-89464 Overview
CVE-2026-89464 is a use-after-free vulnerability in the Linux kernel twl4030_charger power supply driver. The flaw resides in drivers/power/supply/twl4030_charger.c, where the driver-managed (devm) bci structure can be freed while two workers, bci->work and bci->current_worker, still hold references to it. The twl4030_bci_remove() routine disables charging and masks interrupts but does not cancel these workers, allowing a pending worker to run after devm releases bci. The fix converts the workers to devm_work_autocancel() and devm_delayed_work_autocancel() so they are cancelled during devm release before bci is freed.
Critical Impact
A worker executing after bci is freed can dereference stale memory in kernel context, leading to memory corruption or a kernel crash on affected TWL4030-based platforms.
Affected Products
- Linux kernel power: supply: twl4030_charger driver
- Platforms using the TI TWL4030 PMIC battery charger (for example, OMAP3-based devices)
- Stable kernel branches prior to the fixes referenced in the upstream commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89464 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89464
Vulnerability Analysis
The twl4030_charger driver allocates its private bci structure using device-managed (devm) allocation. Two workers dereference bci during their execution: bci->work and bci->current_worker. The driver's twl4030_bci_remove() function disables the charger hardware and masks interrupts but never calls cancel_work_sync() or cancel_delayed_work_sync() on either worker. When the device is removed, devm frees bci after remove() returns, but a worker already queued or in-flight can subsequently run and access the freed memory.
A secondary race exists with the USB transceiver notifier acquired through devm_usb_get_phy_by_node(). Because devm unregisters the notifier only after remove() returns, a naive cancel_work_sync() inside remove() could race a notifier callback that reschedules the worker. The upstream fix therefore registers current_worker first and then bci->work, relying on devm's reverse-order release so that bci->work (which can reschedule current_worker) is cancelled before current_worker.
Root Cause
The root cause is a lifetime mismatch between the devm-allocated bci object and the workqueue items that reference it [CWE-416]. Without an explicit teardown that cancels the workers before devm frees bci, any pending or currently executing worker can dereference freed memory.
Attack Vector
Triggering the flaw requires device removal or driver unbind on hardware that uses the twl4030_charger driver. Because the trigger is local and dependent on module unload or physical/logical device removal, exploitation is bounded to local scenarios on affected embedded platforms. The consequences are memory corruption or kernel oops rather than remote code execution.
No verified exploit code is public. See the upstream commits for the exact patch, including Kernel Git Commit c46c205 and Kernel Git Commit e9fffe1.
Detection Methods for CVE-2026-89464
Indicators of Compromise
- Kernel oops or general protection fault traces referencing twl4030_bci_usb_work, twl4030_current_worker, or symbols in twl4030_charger.c shortly after module unload or device unbind.
- KASAN use-after-free reports naming the bci allocation site in twl4030_charger_probe().
- Unexpected reboots or panics on TWL4030/OMAP3-based devices during power-management or driver hot-unplug events.
Detection Strategies
- Enable CONFIG_KASAN on test builds to surface the use-after-free during driver unbind or module removal cycles.
- Compare installed kernel commit hashes against the fixed commits (c46c205, e9fffe1, 6eba347, 72a2d6c, 9644c96, a4460e8, b955da8) using uname -a and distribution changelogs.
- Review dmesg after echo <dev> > /sys/bus/platform/drivers/twl4030_bci/unbind sequences for late worker execution warnings.
Monitoring Recommendations
- Forward kernel logs from embedded Linux fleets to a centralized log store and alert on oops or KASAN signatures involving twl4030.
- Track kernel package versions across managed Linux hosts to confirm patched builds are deployed on affected hardware.
How to Mitigate CVE-2026-89464
Immediate Actions Required
- Upgrade to a stable kernel release that includes the devm_work_autocancel() and devm_delayed_work_autocancel() conversion for twl4030_charger.
- On hardware using the TWL4030 PMIC, avoid unbinding or unloading the twl4030_charger driver on unpatched kernels.
- Rebuild and redeploy vendor kernels for embedded devices (for example, OMAP3-based products) after cherry-picking the referenced upstream commits.
Patch Information
The fix converts the two workers to devm-managed autocancel variants so they are cancelled during devm release, before bci is freed. The current_worker is registered before bci->work so that reverse-order devm cleanup cancels bci->work first, preventing it from rescheduling current_worker. Patched commits include Kernel Git Commit 6eba347, Kernel Git Commit 72a2d6c, Kernel Git Commit 9644c96, Kernel Git Commit a4460e8, Kernel Git Commit b955da8, Kernel Git Commit c46c205, and Kernel Git Commit e9fffe1.
Workarounds
- Blacklist the twl4030_charger module on systems that do not require battery charger management, using /etc/modprobe.d/ blacklist entries.
- Restrict root access to sysfs driver bind/unbind interfaces to reduce the likelihood of triggering the race on unpatched kernels.
- Where feasible, keep the driver permanently bound for the device lifetime rather than dynamically unbinding it.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.