CVE-2026-89467: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89467 Overview

CVE-2026-89467 is a use-after-free vulnerability in the Linux kernel's qcom_battmgr power supply driver. The flaw resides in the Qualcomm PMIC GLINK battery manager component, which handles firmware requests for battery status on Qualcomm platforms. The qcom_battmgr_pdr_notify() function queues enable_work when the PMIC GLINK service becomes available. A pending or running worker can access the battmgr structure after devres has already freed it, leading to memory corruption. The issue was identified through an in-house static analysis tool and has been resolved in upstream kernel commits.

Critical Impact
A use-after-free condition in the Qualcomm battery manager driver can lead to kernel memory corruption, potential denial of service, or local privilege escalation on affected Qualcomm-based Linux systems.

Affected Products

Linux kernel builds including the qcom_battmgr power supply driver
Qualcomm-based platforms using the PMIC GLINK service
Distributions shipping vulnerable kernel versions prior to the referenced upstream fixes

Discovery Timeline

2026-09-11 - CVE CVE-2026-89467 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89467

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the qcom_battmgr driver located in the Linux kernel power supply subsystem. The driver registers a PMIC GLINK client to communicate with battery firmware on Qualcomm platforms. When the PMIC GLINK service comes up, qcom_battmgr_pdr_notify() queues enable_work. The worker then retrieves the battmgr structure through container_of() to issue firmware requests.

The lifecycle mismatch between the PMIC GLINK client and the battmgr allocation creates the flaw. The client remains on the client list until its devres release action runs. This means PDR notifications can continue queuing enable_work after battmgr has been freed by devres cleanup, allowing the worker to dereference freed memory.

Root Cause

The root cause is improper ordering of resource cleanup. The PMIC GLINK client was not released before the battmgr structure, and enable_work was not device-managed. As a result, notifications arriving during teardown could queue work targeting an already-freed object. The upstream fix converts enable_work to device-managed using devm_work_autocancel(), registered before the PMIC GLINK client is allocated, so devres cleanup releases the client first and cancels pending work before battmgr is freed.

Attack Vector

Exploitation requires triggering PDR notifications during a narrow window when the driver is being torn down or reprobed. A local attacker with the ability to influence PMIC GLINK service state transitions, combined with driver bind/unbind operations, could race the worker against the devres cleanup. Successful exploitation results in dereferencing freed kernel memory, which may cause kernel panic or, with additional heap grooming, controlled memory corruption.

No public proof-of-concept exploit is available, and the flaw was identified through static analysis rather than active exploitation. The EPSS score reflects a low observed likelihood of exploitation in the wild.

Detection Methods for CVE-2026-89467

Indicators of Compromise

Unexpected kernel oops or panic messages referencing qcom_battmgr, enable_work, or container_of traces in dmesg
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the power supply subsystem on Qualcomm hardware
Repeated PMIC GLINK service restarts correlated with battery manager worker activity

Detection Strategies

Enable KASAN on test kernels to catch use-after-free conditions in the qcom_battmgr code path during QA cycles
Audit installed kernel package versions against the upstream fix commits 06618447, 49fbcd3d, and 4e40befe
Monitor kernel logs for driver rebind events involving qcom_battmgr and correlate with subsequent instability

Monitoring Recommendations

Aggregate kernel crash telemetry and stack traces from Qualcomm-based Linux endpoints into a centralized log platform
Track kernel package versions across the fleet to identify hosts still running vulnerable builds
Alert on abnormal frequency of PMIC GLINK notification callbacks or worker queue exhaustion

How to Mitigate CVE-2026-89467

Immediate Actions Required

Inventory all Qualcomm-based Linux systems running kernels that include the qcom_battmgr driver
Apply the upstream stable kernel updates containing commits 06618447029c, 49fbcd3da295, and 4e40befedfc8
Prioritize patching for mobile, embedded, and IoT devices where local attackers may have driver interaction paths

Patch Information

The fix is available in the Linux stable kernel tree. It converts enable_work to a device-managed workqueue entry using devm_work_autocancel(), registered before the PMIC GLINK client. This ensures the client is released first during devres cleanup, preventing further notifications from queuing the work, and cancels any pending work before battmgr is freed. Refer to the Kernel Git Commit 0661844, Kernel Git Commit 49fbcd3, and Kernel Git Commit 4e40bef for the patch content.

Workarounds

Disable the qcom_battmgr driver on systems where battery firmware queries are not required by blacklisting the module
Restrict local access and driver bind/unbind privileges to trusted administrators on affected devices
Avoid manual driver rebind operations on production Qualcomm-based systems until the patch is applied

bash

# Verify kernel version and check for the qcom_battmgr module
uname -r
lsmod | grep qcom_battmgr

# Optional: blacklist the module if battery manager functionality is not needed
echo "blacklist qcom_battmgr" | sudo tee /etc/modprobe.d/blacklist-qcom-battmgr.conf
sudo update-initramfs -u