CVE-2026-89473 Overview
CVE-2026-89473 is a resource management flaw in the Linux kernel's bq25890 battery charger driver. The bq25890_fw_probe() function acquires a reference to a secondary charger through power_supply_get_by_name() but fails to release it on later probe failures or driver detachment. Subsequent failures in bq25890_hw_init() also leak the reference. The issue was identified through code review and has been resolved across multiple stable kernel branches.
Critical Impact
Repeated probe failures or driver bind/unbind cycles gradually exhaust kernel power_supply object references, potentially causing resource leaks on affected systems using the bq25890 charger IC.
Affected Products
- Linux kernel drivers/power/supply/bq25890_charger.c
- Systems using the Texas Instruments BQ25890 battery charger IC
- Multiple stable Linux kernel branches (fixes backported across five commits)
Discovery Timeline
- 2026-09-11 - CVE-2026-89473 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89473
Vulnerability Analysis
The defect exists in the Linux kernel power supply subsystem, specifically the driver for the Texas Instruments BQ25890 battery charger. During firmware probing, bq25890_fw_probe() calls power_supply_get_by_name() to obtain a reference to a secondary charger device. This function increments the reference count on the target power_supply object.
The original code did not pair this acquisition with a corresponding release path. If probing later failed, for example inside bq25890_hw_init(), the driver returned an error without dropping the reference. Detaching the driver produced the same leak. Each failed probe or unbind event permanently pinned the referenced power_supply object in memory.
The fix registers a device-managed cleanup action immediately after acquiring the reference. This ties the release of the reference to the driver's device lifecycle, ensuring the count is decremented on all subsequent failure paths and on detach.
Root Cause
The root cause is a missing cleanup path for a reference-counted kernel object, classified as a memory leak. The driver acquired ownership of a power_supply reference without registering a release action through devm_add_action_or_reset() or an equivalent mechanism. Error paths and the remove path bypassed the required power_supply_put() call.
Attack Vector
This vulnerability does not present a direct remote or local exploitation path. Triggering the leak requires repeated probe failures or bind/unbind cycles of the bq25890 driver, operations that typically require root privileges. The impact is limited to resource exhaustion on affected hardware. No proof-of-concept exploit exists and the flaw was found through code review.
The vulnerability manifests in the driver's probe path. See the referenced kernel commits for the exact code changes.
Detection Methods for CVE-2026-89473
Indicators of Compromise
- Growing kernel memory consumption on systems using the bq25890 charger driver over long uptimes
- Repeated driver probe failure messages in dmesg referencing bq25890 or bq25890_hw_init
- Elevated reference counts on power_supply objects visible through sysfs under /sys/class/power_supply/
Detection Strategies
- Audit installed kernel versions on Linux endpoints and compare against the fixed commits (238320a, 58f1025, 81b558a, 863c32a, 976c10d)
- Monitor kernel logs for repeated bq25890 probe errors that would trigger the leak path
- Use kmemleak or similar kernel debugging facilities during QA to identify orphaned power_supply references
Monitoring Recommendations
- Track kernel version inventory across Linux fleets, particularly embedded and mobile devices that ship BQ25890-based charging hardware
- Alert on unexpected driver bind/unbind cycles for power management drivers
- Collect and correlate kernel logs into a central data store for longitudinal analysis of subsystem errors
How to Mitigate CVE-2026-89473
Immediate Actions Required
- Identify Linux systems running kernels that include the vulnerable bq25890 driver, focusing on embedded, IoT, and mobile devices
- Apply vendor-provided kernel updates that include one of the fix commits published to the stable tree
- Restrict privileged operations that repeatedly bind and unbind the bq25890 driver until patches are deployed
Patch Information
The fix is available in the mainline and stable Linux kernel trees through the following commits: Linux Kernel Commit 238320a, Linux Kernel Commit 58f1025, Linux Kernel Commit 81b558a, Linux Kernel Commit 863c32a, and Linux Kernel Commit 976c10d. The patch registers a device-managed cleanup action immediately after acquiring the secondary charger reference, ensuring release on all probe failure paths and driver detach.
Workarounds
- No functional workaround exists that preserves driver functionality; upgrading to a patched kernel is the recommended path
- Where patching is deferred, avoid operational patterns that repeatedly reload or fail-probe the bq25890 driver
- Consider blacklisting the driver on systems that do not require charger management, using standard kernel module configuration
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
