CVE-2026-89465: Linux Kernel rt9455 Use-After-Free Vulnerability

CVE-2026-89465 Overview

CVE-2026-89465 is a use-after-free vulnerability in the Linux kernel rt9455 power supply driver. The flaw stems from improper teardown ordering of delayed work items in the rt9455_remove() function and the probe error path. The threaded IRQ handler and several delayed work callbacks can requeue each other, allowing work to be scheduled after cancellation and after the rt9455_info device resource has been freed by devres. A pending callback can then dereference freed memory, leading to memory corruption.

Critical Impact
A local attacker with the ability to trigger driver unbind or probe failure can cause kernel memory corruption, resulting in denial of service or potential privilege escalation.

Affected Products

Linux kernel builds including the rt9455 power supply driver (drivers/power/supply/rt9455.c)
Systems using the Richtek RT9455 battery charger IC
Multiple stable kernel branches prior to the fixing commits

Discovery Timeline

2026-09-11 - CVE-2026-89465 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89465

Vulnerability Analysis

The rt9455 driver uses three delayed work items: pwr_rdy_work, max_charging_time_work, and batt_presence_work. The threaded IRQ handler can queue any of the three. Both pwr_rdy_work and batt_presence_work can queue max_charging_time_work, and batt_presence_work can requeue itself.

The original rt9455_remove() cancelled max_charging_time_work before batt_presence_work. Because batt_presence_work can queue max_charging_time_work, the cancellation ordering left a window where a stale work item could be scheduled after teardown began. Devres then frees the rt9455_info structure while a callback still holds a reference, producing a classic use-after-free condition [CWE-416].

The probe error path is affected as well. If rt9455_hw_init() fails after the IRQ is requested, probe returns without cancelling any work that the IRQ handler may have already queued, leaving a pending callback that will access freed memory.

Root Cause

The root cause is incorrect lifecycle management of asynchronous work relative to devres-managed resources. Cancellation ordering did not account for cross-queuing between delayed work items, and no drain occurred between IRQ release and freeing of the driver context.

Attack Vector

Exploitation requires local access with the ability to trigger driver unbind, module unload, or probe failure. The attack does not require user interaction or elevated privileges to reach the vulnerable code path, but the resulting kernel memory corruption is what elevates impact.

See the upstream fixes for implementation details:

Detection Methods for CVE-2026-89465

Indicators of Compromise

Kernel oops or panic traces referencing rt9455_info, max_charging_time_work, batt_presence_work, or pwr_rdy_work
KASAN reports indicating use-after-free in drivers/power/supply/rt9455.c during module unload or probe failure
Unexpected system instability after unbinding or reloading the rt9455 driver

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to catch use-after-free access on rt9455_info
Audit installed kernel versions against the upstream stable commits that introduce rt9455_cancel_all_delayed_works() via devm_add_action_or_reset()
Correlate kernel crash dumps with driver unbind or hotplug events involving the rt9455 charger IC

Monitoring Recommendations

Forward kernel logs (dmesg, journald) to a centralized log platform and alert on stack traces referencing the rt9455 driver
Track driver bind and unbind events under /sys/bus/i2c/drivers/rt9455/ for anomalous activity on affected devices
Monitor for repeated probe failures on the I2C bus hosting the RT9455 charger

How to Mitigate CVE-2026-89465

Immediate Actions Required

Apply the upstream stable kernel patches that register rt9455_cancel_all_delayed_works() through devm_add_action_or_reset()
Rebuild and deploy vendor kernel images that include the fix on all systems using the rt9455 driver
Restrict local access to systems where kernel patching is not yet feasible, since exploitation requires local privileges

Patch Information

The fix registers a cancellation action right after devm_power_supply_register(). Devres invokes cleanup actions in reverse registration order, so delayed work is drained after the managed IRQ has been freed and before rt9455_info is released. The patch also cancels pwr_rdy_work and batt_presence_work before max_charging_time_work because both can queue the latter. The corrected teardown covers both rt9455_remove() and the probe error path. Refer to the linked kernel.org commits above for the exact backport for each stable branch.

Workarounds

Avoid unbinding or unloading the rt9455 driver on unpatched systems
Disable or blacklist the rt9455 module on hardware where the RT9455 charger is not required
Limit shell and physical access to affected embedded devices until vendor firmware includes the fix

bash

# Blacklist the rt9455 module on unpatched systems
echo "blacklist rt9455" | sudo tee /etc/modprobe.d/blacklist-rt9455.conf
sudo update-initramfs -u