CVE-2026-89474: Linux Kernel bq256xx Use-After-Free Vulnerability

CVE-2026-89474 Overview

CVE-2026-89474 is a use-after-free vulnerability in the Linux kernel's bq256xx power supply driver. The flaw resides in the USB-PHY notifier registration ordering within the battery charger driver. The USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq->charger). Because the reset devm action only unregistered the notifier and was registered before the power supplies, devm frees bq->charger on unwind before the action runs. A usb_work item still queued at that point can then dereference freed memory. The issue was identified through static analysis and fixed by reordering registration so the reset action drains usb_work before the supplies are released.

Critical Impact
A queued work item can dereference a freed power_supply structure during driver teardown, leading to kernel memory corruption or system instability on affected devices using the bq256xx charger.

Affected Products

Linux kernel builds including the bq256xx power supply driver
Devices using Texas Instruments bq256xx battery charger ICs with USB-PHY notifier integration
Stable kernel branches referenced by the upstream fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89474 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89474

Vulnerability Analysis

The bq256xx driver manages battery charging over I2C and integrates with the USB-PHY subsystem to react to cable events. When a USB-PHY notification fires, the driver queues usb_work, a deferred work item whose handler calls power_supply_changed(bq->charger). The handler dereferences the bq->charger pointer to notify user space of state changes.

During device teardown, devm-managed resources are released in reverse registration order. The original code registered the reset devm action, which unregisters the USB-PHY notifier, before allocating the power supplies. As a result, devm freed bq->charger before running the notifier-unregister action. Any usb_work still pending on the workqueue could then execute against a freed power_supply object.

Root Cause

The root cause is incorrect ordering of resource registration in the probe path combined with an incomplete teardown action. Unregistering the notifier alone does not guarantee that in-flight usb_work completes before dependent resources are freed. Without an explicit cancel_work_sync or flush_work on usb_work, the worker can race with resource release. This is a classic use-after-free [CWE-416] pattern in driver lifecycle management.

Attack Vector

Triggering the flaw requires driver unbind, module unload, or probe failure on a system with the bq256xx driver bound to a charger IC connected through a USB-PHY. USB cable state transitions during teardown increase the probability of a queued usb_work racing with resource release. The condition is not remotely reachable and typically requires local physical or administrative interaction with the affected device. Exploitation results in kernel memory corruption rather than a controlled code execution primitive.

The upstream fix registers the reset action after the power supplies, initializes usb_work and obtains the PHY references before registering the notifiers, and ensures usb_work is drained before the supplies are released. See the Kernel Git Commit 9dcfdf6 and the Kernel Git Commit c8addb8 for the corrected teardown sequence.

Detection Methods for CVE-2026-89474

Indicators of Compromise

Kernel oops or panic messages referencing power_supply_changed, usb_work, or the bq256xx module during driver unbind or shutdown
KASAN reports flagging use-after-free access to a power_supply structure allocated by the bq256xx probe path
Unexpected charger subsystem reinitializations following USB cable state transitions on affected hardware

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test builds to catch use-after-free access on bq->charger during driver teardown
Review kernel version and patch level against the fix commits listed in the NVD advisory
Audit downstream vendor kernels shipping the bq256xx driver to confirm the reordering patch has been backported

Monitoring Recommendations

Collect dmesg and journal output from Linux endpoints and embedded devices; forward to a central log store for kernel fault correlation
Alert on kernel oops signatures containing bq256xx, usb_work, or power_supply_changed symbols
Track module load and unload events for the bq256xx driver to identify teardown paths where the race can trigger

How to Mitigate CVE-2026-89474

Immediate Actions Required

Inventory Linux systems and embedded devices that load the bq256xx driver and identify their kernel versions
Apply the upstream stable kernel updates that include the reordering fix for the bq256xx teardown path
Coordinate with hardware vendors and distribution maintainers to obtain backported patches for long-term support kernels

Patch Information

The fix is committed to upstream Linux and stable branches. Reference the corrected teardown ordering in the following commits:

Workarounds

If patching is not immediately possible, blacklist the bq256xx module on systems where the charger IC is not required
Avoid runtime unbind of the bq256xx driver on affected kernels; keep the driver bound for the lifetime of the system
Restrict local administrative access that could initiate module unload or driver rebind sequences on production devices