CVE-2026-89475 Overview
CVE-2026-89475 is a use-after-free vulnerability in the Linux kernel's bq24257 battery charger power supply driver. The flaw resides in the driver's remove() path, where the STAT-pin threaded interrupt handler can reschedule delayed work against memory that has already been freed by the devm cleanup routine. The issue was identified through static analysis and resolved by converting the delayed work to a device-managed lifecycle using devm_delayed_work_autocancel(). Exploitation requires local access to a system running the affected driver during a module unload or device removal event.
Critical Impact
A race between the devm-managed STAT-pin interrupt and the driver's remove() cleanup can dereference freed kernel memory, leading to kernel memory corruption or denial of service.
Affected Products
- Linux kernel power: supply: bq24257 driver
- Multiple stable kernel branches referenced in upstream fix commits
- Systems using the Texas Instruments BQ24257 battery charger IC
Discovery Timeline
- 2026-09-11 - CVE-2026-89475 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89475
Vulnerability Analysis
The bq24257 driver manages a Texas Instruments battery charger and registers a threaded interrupt handler for the STAT pin using devm (device-managed) allocation. The handler reschedules bq->iilimit_setup_work and dereferences the driver's private bq structure. During module removal, the driver's remove() function calls cancel_delayed_work_sync() on the delayed work. Because the interrupt remains armed until devm cleanup runs after remove() returns, the handler can fire between the explicit cancel and devm freeing bq. The handler then reschedules the work and touches freed memory, producing a classic use-after-free condition [CWE-416].
Root Cause
The root cause is incorrect teardown ordering between two devm-managed resources and a manually cancelled work item. The STAT-pin threaded interrupt is released only during devm cleanup, but the delayed work it reschedules is cancelled earlier inside remove(). This ordering leaves a window where the handler runs, reschedules the work, and the work then executes against memory freed by devm. The fix registers the delayed work with devm_delayed_work_autocancel() before the interrupt request, ensuring devm releases the interrupt first and cancels the work before freeing the driver structure.
Attack Vector
Triggering this flaw requires local privileges sufficient to unbind or unload the bq24257 driver, typically root on a system with the affected hardware. An attacker who can force repeated bind/unbind cycles while the STAT-pin interrupt fires may induce the race. Successful exploitation results in kernel memory being read or written after free, which can manifest as a kernel oops, denial of service, or potential memory corruption depending on subsequent allocator behavior. No network attack vector exists for this driver-specific issue.
No public proof-of-concept code is available. Technical details of the fix are documented in the upstream kernel commits referenced by Kernel Git Commit 47ccba and Kernel Git Commit a279e6.
Detection Methods for CVE-2026-89475
Indicators of Compromise
- Kernel oops or panic messages referencing bq24257, iilimit_setup_work, or bq24257_iilimit_setup_work in dmesg or /var/log/kern.log.
- KASAN reports of use-after-free in the bq24257 driver during module unload or device removal.
- Unexpected system instability correlated with unbind or hot-remove events on affected charger hardware.
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test builds to surface the use-after-free deterministically during driver removal.
- Audit installed kernel packages against distribution advisories that reference the upstream fix commits listed in the NVD entry.
- Monitor for modprobe -r bq24257 or driver unbind operations via auditd rules on production systems.
Monitoring Recommendations
- Collect and centralize kernel logs so bq24257 faults during device teardown are visible to incident responders.
- Alert on kernel oops events and repeated bind/unbind sequences targeting power supply drivers.
- Track kernel package versions across the fleet to confirm patched builds are deployed on systems using the affected hardware.
How to Mitigate CVE-2026-89475
Immediate Actions Required
- Apply the kernel updates that include the fix converting bq->iilimit_setup_work to devm_delayed_work_autocancel() and removing the explicit cancel_delayed_work_sync() from remove().
- Restrict unprivileged access to module load/unload operations and to sysfs unbind interfaces for the bq24257 driver.
- Prioritize patching on embedded and mobile Linux devices that ship with the Texas Instruments BQ24257 charger.
Patch Information
Upstream fixes are available across multiple stable branches. Reference commits include Kernel Git Commit 47ccba, Kernel Git Commit 6d2eba, Kernel Git Commit 861ec7, Kernel Git Commit 9d34c9, Kernel Git Commit 9d77fd, Kernel Git Commit a279e6, and Kernel Git Commit f49580. Rebuild and reboot into the patched kernel to activate the fix.
Workarounds
- Blacklist the bq24257 module on systems that do not require the driver until a patched kernel is deployed.
- Avoid driver unbind and rebind operations on affected hardware in production environments.
- Limit access to root and to CAP_SYS_MODULE so untrusted users cannot trigger the removal path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
