CVE-2026-89468: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89468 Overview

CVE-2026-89468 is a use-after-free vulnerability in the Linux kernel's lp8788-charger power supply driver. The flaw resides in lp8788_charger_remove(), which flushes charger_work before unregistering the driver's IRQs. A threaded IRQ handler can queue charger_work after flush_work() returns, allowing the deferred work to execute after devres frees the pchg structure. When lp8788_charger_event() subsequently dereferences the freed memory, it triggers a use-after-free condition. The issue was identified by an in-house static analysis tool and resolved by reordering teardown so that IRQs are freed first, followed by cancel_work_sync() on any pending work.

Critical Impact
Use-after-free during driver removal can lead to kernel memory corruption, denial of service, or potential local privilege escalation on systems using the LP8788 charger IC.

Affected Products

Linux kernel builds containing the lp8788-charger power supply driver
Distributions shipping the affected drivers/power/supply/lp8788-charger.c code
Embedded and mobile platforms integrating the TI LP8788 power management IC

Discovery Timeline

2026-09-11 - CVE-2026-89468 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89468

Vulnerability Analysis

The vulnerability is a classic use-after-free (UAF) race condition triggered during driver teardown. The Linux lp8788-charger driver manages battery charging on systems using the TI LP8788 PMIC. During removal, the driver must synchronize deferred work and interrupt handlers with the release of driver-private memory managed by the device resource management (devres) framework.

The original teardown sequence flushed charger_work first, then unregistered IRQs. This ordering is unsafe: a threaded IRQ handler running concurrently can queue charger_work after flush_work() has already returned. Once lp8788_charger_remove() completes, devres releases the pchg allocation. The queued work then runs on stale memory and dereferences pchg inside lp8788_charger_event().

Root Cause

The root cause is incorrect teardown ordering between IRQ deregistration and work cancellation. flush_work() waits only for work already queued at the time of the call. It does not prevent new work from being scheduled afterward by an in-flight interrupt handler. This creates a narrow but reachable window where the driver's private data can be freed while a scheduled work item still holds a pointer to it.

Attack Vector

Triggering the flaw requires the lp8788-charger module to be removed while the LP8788 hardware asserts a charger-related interrupt. On affected embedded and mobile platforms, this can occur during normal power-state transitions, module unload operations, or device rebinding. Successful exploitation could corrupt kernel memory or crash the system. Reliable exploitation for privilege escalation would require additional primitives to shape the freed slab allocation.

The fix, described in the upstream commits, unregisters IRQs before touching the work queue. free_irq() blocks until any running threaded handler completes, ensuring no further work can be queued. cancel_work_sync() then cancels or waits on any remaining work before devres reclaims pchg.

Detection Methods for CVE-2026-89468

Indicators of Compromise

Kernel oops or panic traces referencing lp8788_charger_event or lp8788_charger_remove
KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads in drivers/power/supply/lp8788-charger.c
Slab corruption warnings occurring shortly after unbinding or unloading the lp8788-charger module

Detection Strategies

Enable KASAN and lockdep on test builds to surface the UAF condition during driver unbind or module removal stress tests
Inventory running kernels for the affected driver by checking /proc/modules and matching against patched stable kernel versions from the upstream commits b4eb6a0, b3aa1e9, 88d8ead, and 831c29a
Correlate kernel ring buffer messages (dmesg) with charger IRQ activity around module unload events

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized log platform and alert on BUG: or KASAN: entries mentioning charger driver symbols
Track kernel package versions across Linux fleets and flag hosts still running vulnerable builds of the lp8788-charger driver
Monitor for unexpected module unload or rebind operations on production embedded devices

How to Mitigate CVE-2026-89468

Immediate Actions Required

Apply the upstream stable kernel updates that contain the reordered teardown sequence for lp8788_charger_remove()
Rebuild and redeploy custom kernels that include drivers/power/supply/lp8788-charger.c after backporting the fix
Avoid dynamic unloading or rebinding of the lp8788-charger module on unpatched systems in production

Patch Information

The fix has been merged into the upstream Linux stable trees. Refer to the following commits for the corrected teardown ordering:

The patch replaces the original flush_work()-then-free_irq() order with free_irq()-then-cancel_work_sync(), closing the race window between threaded IRQ delivery and devres teardown.

Workarounds

Blacklist the lp8788-charger module on systems where the LP8788 PMIC is not required until a patched kernel is deployed
Restrict access to module management operations by ensuring CAP_SYS_MODULE is limited to trusted administrators
Disable driver auto-unbind through sysfs on affected devices to prevent triggering the removal path in production