CVE-2026-89797: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89797 Overview

CVE-2026-89797 is a use-after-free vulnerability in the Linux kernel's ab8500_fg power supply driver. The flaw resides in ab8500_fg_remove(), which destroys the driver workqueue while threaded interrupt handlers remain armed. Because the interrupts are devm-managed, the kernel frees them only after ->remove() returns. An interrupt firing in that window queues work on a workqueue that has already been destroyed, producing a use-after-free condition. The issue was discovered by an in-house static analysis tool and resolved by tearing down the workqueue through devm so the interrupts are released before the workqueue disappears.

Critical Impact
A use-after-free during driver unbind or module removal can corrupt kernel memory and destabilize the system running the ab8500_fg fuel gauge driver.

Affected Products

Linux kernel power: supply: ab8500_fg driver
Systems using the AB8500 fuel gauge power supply component
Kernel branches referenced in the upstream stable commits 013731074ab6, 75b1e88d3425, and c660c017dec1

Discovery Timeline

2026-09-16 - CVE-2026-89797 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89797

Vulnerability Analysis

The ab8500_fg driver manages the AB8500 fuel gauge, coordinating measurement work through a dedicated workqueue and several threaded interrupt handlers. During removal, ab8500_fg_remove() calls destroy_workqueue() directly on the driver-owned workqueue. However, the threaded interrupts registered against the same device are managed by the device resource manager (devm), meaning the kernel only releases them after ->remove() returns.

This ordering mismatch creates a race window. If a fuel gauge interrupt fires between the workqueue teardown and the eventual devm cleanup, the handler queues work onto memory that has already been freed. The external_power_changed callback from the power-supply core can also requeue work during this window, extending the exposure.

Root Cause

The root cause is incorrect resource lifetime management [CWE-416]. The workqueue is destroyed manually, but the producers that can enqueue work into it are freed later by devm. The fix registers workqueue cleanup through devm_add_action_or_reset(), placing it after the power supply registration and before the interrupt requests. devm then releases the interrupts first, disables the delayed and plain work items, and finally destroys the workqueue. Disabling work items rather than cancelling them prevents any producer from requeuing them.

Attack Vector

Triggering the flaw requires local interaction with the affected device. An unprivileged process cannot directly invoke the removal path, but administrative unbind operations, module unload, or device hotplug events on hardware carrying the AB8500 fuel gauge can reach the vulnerable code. Successful exploitation results in kernel memory corruption, which can lead to a denial-of-service crash or, in principle, further memory corruption primitives on affected kernels.

No public proof-of-concept exploit is currently available. See the upstream fix commits for the exact patch flow: kernel.org commit 01373107, kernel.org commit 75b1e88d, and kernel.org commit c660c017.

Detection Methods for CVE-2026-89797

Indicators of Compromise

Kernel oops or panic traces referencing ab8500_fg, queue_work, or queue_delayed_work shortly after driver unbind or module removal.
KASAN reports flagging use-after-free access inside destroyed workqueue structures on kernels running the AB8500 fuel gauge driver.
Unexpected reboots on embedded devices using the AB8500 PMIC during suspend, resume, or power supply transitions.

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_OBJECTS_WORK on test kernels to catch use-after-free on workqueue objects during unbind sequences.
Correlate kernel ring buffer output with driver bind/unbind events from udev and sysfs to identify the vulnerable timing window.
Track kernel package versions across the fleet and flag hosts running unpatched kernels that ship the ab8500_fg driver.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a central analytics platform and alert on ab8500_fg stack traces.
Monitor /sys/bus/platform/drivers/ab8500-fg/unbind writes and module unload events on production hardware.
Track kernel crash dumps for signatures matching workqueue-related use-after-free patterns after power supply subsystem activity.

How to Mitigate CVE-2026-89797

Immediate Actions Required

Apply the upstream stable patches referenced in the kernel git commits 013731074ab6, 75b1e88d3425, and c660c017dec1.
Rebuild and deploy kernels on any device that instantiates the AB8500 fuel gauge driver, prioritizing embedded and industrial platforms.
Restrict administrative access to driver unbind interfaces under /sys/bus/platform/drivers/ on affected systems.

Patch Information

The fix converts the workqueue teardown into a devm-managed cleanup registered after the power supply and before the threaded interrupts. This guarantees the kernel releases the interrupt handlers first, then disables the delayed and plain work items, and finally destroys the workqueue. Consult the upstream commits 013731074ab6, 75b1e88d3425, and c660c017dec1 for the exact patch content and the affected stable branches.

Workarounds

Avoid unbinding or unloading the ab8500_fg driver on production systems until a patched kernel is installed.
Blacklist the ab8500_fg module on hardware where the fuel gauge is not required, using /etc/modprobe.d/ configuration.
Restrict access to sysfs unbind entries and module management tools to trusted administrators only.

bash

# Configuration example: prevent driver unbind and module reload on affected hosts
echo 'blacklist ab8500_fg' | sudo tee /etc/modprobe.d/cve-2026-89797.conf
sudo chmod 600 /sys/bus/platform/drivers/ab8500-fg/unbind
sudo dmesg -w | grep -i ab8500_fg