CVE-2026-89469 Overview
CVE-2026-89469 is a use-after-free vulnerability in the Linux kernel's lp8727 power supply charger driver. The flaw resides in lp8727_release_irq(), which cancels a delayed work item before freeing the associated interrupt request (IRQ). An IRQ delivered during that window can re-arm pchg->work through the threaded handler lp8727_isr_func(). After .remove returns, the device-managed (devm) layer frees pchg while lp8727_delayed_func() may still execute and dereference the freed memory. The issue was identified by an in-house static analysis tool and resolved by reordering the teardown to free the IRQ first, then cancel the delayed work.
Critical Impact
Local exploitation of this use-after-free can lead to kernel memory corruption, escalation of privileges, or system compromise on Linux systems with the lp8727 charger driver loaded.
Affected Products
- Linux kernel drivers/power/supply/lp8727_charger.c
- Distributions shipping vulnerable Linux kernel versions prior to the patched commits
- Embedded and mobile Linux platforms using the TI LP8727 charger IC
Discovery Timeline
- 2026-09-11 - CVE-2026-89469 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89469
Vulnerability Analysis
The lp8727 driver manages a delayed work item (pchg->work) that is scheduled from the threaded IRQ handler lp8727_isr_func() via schedule_delayed_work(). During driver removal, lp8727_release_irq() originally called cancel_delayed_work_sync() prior to freeing the IRQ line. Because the IRQ line remained active, an interrupt delivered between the cancel and free operations could invoke the threaded handler and re-queue the delayed work.
Once .remove returns control to the driver core, the devm (device-managed resource) layer frees the private pchg structure. The still-pending lp8727_delayed_func() then runs against freed memory, dereferencing pointers within pchg. This constitutes a classic use-after-free ([CWE-416]) in kernel context.
Root Cause
The root cause is an incorrect ordering of teardown operations in lp8727_release_irq(). Cancelling the delayed work before quiescing the IRQ source leaves a race window in which the threaded handler can re-arm the work. The fix inverts the order: free_irq() first, ensuring the threaded handler cannot run, then cancel_delayed_work_sync() drains the final work generation.
Attack Vector
Exploitation requires local access to trigger driver unbind or module removal on a system with the lp8727 charger IC. An attacker able to induce an interrupt at the precise removal window can cause the delayed work to reference freed memory. Successful exploitation may yield kernel memory corruption, information disclosure, or privilege escalation. Refer to the upstream kernel commits for technical details of the fix.
Detection Methods for CVE-2026-89469
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing lp8727_delayed_func or lp8727_charger in dmesg and /var/log/kern.log
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the power_supply subsystem
- Sudden system instability or reboots correlated with driver unbind, module unload, or device hot-remove events
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free conditions during driver load/unload cycles
- Audit loaded kernel modules with lsmod | grep lp8727 to identify exposed systems
- Monitor for rmmod, modprobe -r, and unbind sysfs writes targeting the lp8727 driver from non-root or unexpected contexts
Monitoring Recommendations
- Collect kernel logs centrally and alert on oops signatures containing lp8727 or power_supply stack frames
- Track kernel package versions across the fleet and flag hosts running unpatched builds
- Correlate driver teardown events with subsequent kernel warnings within a short time window
How to Mitigate CVE-2026-89469
Immediate Actions Required
- Apply the vendor kernel update containing the patched lp8727_release_irq() teardown ordering
- Inventory embedded, mobile, and IoT Linux devices that include the lp8727 charger driver and prioritize patching
- Restrict local access and module management privileges to trusted administrators until patched
Patch Information
The fix reorders teardown so free_irq() runs before cancel_delayed_work_sync(), quiescing the threaded handler before draining the work queue. Patched commits are available upstream: Kernel Commit 035cc6bc, Kernel Commit 1321a4e6, Kernel Commit 6ab31282, Kernel Commit 6f0ce09d, Kernel Commit 80d4e40a, Kernel Commit ab6b1ad7, Kernel Commit ceb6ac43, and Kernel Commit dc1dc283.
Workarounds
- Blacklist the lp8727_charger module on systems that do not require the charger driver
- Restrict permissions on /sys/bus/*/drivers/lp8727*/unbind and module management interfaces to root only
- Avoid runtime driver unbind or module unload operations on unpatched production systems
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
