CVE-2026-89472: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89472 Overview

CVE-2026-89472 is a use-after-free vulnerability in the Linux kernel power: supply: charger-manager subsystem. The flaw stems from incorrect ordering between regulator_put() and power_supply_unregister() in both the driver's .remove() path and the err_reg_extcon probe error path. A concurrent write to the externally_control sysfs attribute can invoke try_charger_enable(), which dereferences already-freed regulator consumer handles. A symmetric race exists on probe, where sysfs entries are exposed before regulators are acquired.

Critical Impact
A local user with permission to write to charger-manager sysfs attributes can trigger a use-after-free in kernel context, enabling privilege escalation, kernel memory corruption, or denial of service.

Affected Products

Linux kernel versions containing the charger-manager power supply driver prior to the fix commits
Distributions shipping vulnerable stable kernel branches (see referenced kernel.org commits)
Embedded and mobile Linux platforms using the charger-manager framework for battery/charger control

Discovery Timeline

2026-09-11 - CVE-2026-89472 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89472

Vulnerability Analysis

The vulnerability is a classic teardown-ordering [CWE-416] use-after-free in the Linux kernel charger-manager driver. During charger_manager_remove() and the err_reg_extcon probe error path, the driver calls regulator_put() on each charger regulator before invoking power_supply_unregister(). The power_supply sysfs entries remain live while the underlying regulator consumer handles are already freed.

A concurrent userspace write to a charger's externally_control sysfs attribute reaches charger_externally_control_store(), which calls try_charger_enable(). When charging is enabled, try_charger_enable() dereferences the freed regulator handle. Additionally, charger_manager_remove() itself invokes try_charger_enable(cm, false) after the regulator_put() loop, producing a direct use-after-free on the removal path when charging was active.

Root Cause

The root cause is asymmetric setup and teardown ordering between the power_supply sysfs interface and the regulator consumer lifecycle. On probe, power_supply_register() runs before charger_manager_register_extcon() acquires regulators via regulator_get(). On teardown, regulators are released before sysfs is torn down. Both windows leave freed handles reachable from userspace-triggered code paths.

Attack Vector

Exploitation requires local access with permission to write the externally_control sysfs attribute on a charger-manager device. An attacker races a write against driver probe or removal to hit the window where sysfs is live but regulator handles are either uninitialized or freed. The vulnerability was found by an in-house static analysis tool according to the upstream commit message. The fix splits charger_manager_register_extcon() on the sync/async boundary, moves power_supply_unregister() and try_charger_enable(cm, false) ahead of regulator_put(), and adjusts the err_reg_extcon label to fall through to err_regulator cleanly. The maintainers note this does not address a separate extcon-notifier-driven dereference, which requires its own synchronization design.

Detection Methods for CVE-2026-89472

Indicators of Compromise

Kernel oops or panic messages referencing try_charger_enable, charger_externally_control_store, or regulator_* symbols in the call stack
KASAN reports indicating use-after-free in the charger-manager driver during device probe, removal, or module unload
Unexpected kernel crashes correlated with writes to /sys/class/power_supply/<charger>/externally_control

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test kernels to catch use-after-free access on charger-manager regulator handles
Audit installed kernel packages against the fix commits 6d532582, 86e4fa65, af3ce383, and c57cb36f on kernel.org stable branches
Monitor auditd for open and write syscalls targeting power_supply sysfs attributes from non-privileged contexts

Monitoring Recommendations

Ingest dmesg and /var/log/kern.log into a centralized logging pipeline and alert on regulator or power_supply subsystem faults
Track driver bind and unbind events (/sys/bus/platform/drivers/charger-manager/) that coincide with sysfs writes
Baseline expected sysfs write patterns on embedded devices and alert on anomalous userspace access to externally_control

How to Mitigate CVE-2026-89472

Immediate Actions Required

Update the Linux kernel to a stable release that includes the upstream fix commits referenced by kernel.org
Restrict write permissions on /sys/class/power_supply/*/externally_control to the root user and audit any userspace daemons that touch these attributes
Where possible, unload or disable the charger-manager driver on systems that do not require software-managed charging

Patch Information

The fix is upstream in the Linux kernel and has been backported to multiple stable branches. Apply the patches referenced in the following commits: Linux Kernel Commit 6d53258, Linux Kernel Commit 86e4fa6, Linux Kernel Commit af3ce38, and Linux Kernel Commit c57cb36. The fix reorders teardown so power_supply_unregister() and try_charger_enable(cm, false) run before regulator_put(), and moves charger_manager_get_regulators() ahead of power_supply_register() on probe.

Workarounds

Tighten filesystem permissions on charger-manager sysfs nodes so only trusted system processes can write externally_control
Avoid runtime bind/unbind cycles of the charger-manager driver on production systems while userspace charger management daemons are active
Apply Linux Security Module policies (SELinux, AppArmor) to confine processes that legitimately need charger sysfs access

bash

# Restrict write access to charger-manager sysfs attributes
for f in /sys/class/power_supply/*/externally_control; do
    [ -e "$f" ] && chmod 600 "$f"
done

# Verify running kernel includes the fix (example for Debian/Ubuntu)
uname -r
apt-cache policy linux-image-$(uname -r)