VulnerabilityPublished 11 Sep 2026Updated 21 Oct 2026

CVE-2026-89468: Linux kernel · power: supply: lp8788-charger: fix use-after-free on remove

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in b4eb6a056b441ba0caedfbfc42cec501acf12f67 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 19:46 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in b4eb6a056b441ba0caedfbfc42cec501acf12f67, b3aa1e9509e1b0a863353356d617fb45d1b6250a, 831c29a12d560f8a3225f43050b3fbb5dfd79c66 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 98a2766493589c18c327ae3dad5243b53fcb5f70, < b4eb6a056b441ba0caedfbfc42cec501acf12f67	Fixed in b4eb6a056b441ba0caedfbfc42cec501acf12f67
LinuxLinux	Affected ≥ 98a2766493589c18c327ae3dad5243b53fcb5f70, < b3aa1e9509e1b0a863353356d617fb45d1b6250a	Fixed in b3aa1e9509e1b0a863353356d617fb45d1b6250a
LinuxLinux	Affected ≥ 98a2766493589c18c327ae3dad5243b53fcb5f70, < 831c29a12d560f8a3225f43050b3fbb5dfd79c66	Fixed in 831c29a12d560f8a3225f43050b3fbb5dfd79c66
LinuxLinux	Affected ≥ 98a2766493589c18c327ae3dad5243b53fcb5f70, < 88d8eadfad5d9ff967e74090152940bcfa27df69	Fixed in 88d8eadfad5d9ff967e74090152940bcfa27df69
LinuxLinux	Affected ≥ 98a2766493589c18c327ae3dad5243b53fcb5f70, < 4e3d3923976a986cc3cf960d13f1264cea8a9bba	Fixed in 4e3d3923976a986cc3cf960d13f1264cea8a9bba
LinuxLinux	Affected =3.7	Fixed in–

AI-suggested

A fix is available and has been applied in specific Linux kernel commits. Users and administrators should update to the fixed kernel versions containing the patches identified by the commit hashes provided. No additional mitigation is required beyond applying the official fix.

Description

A use-after-free vulnerability was identified and fixed in the Linux kernel's lp8788-charger power supply driver. The issue involved improper ordering of IRQ unregistration and work cancellation, which could lead to a use-after-free condition when the charger work was queued after resources were freed. The fix involves unregistering IRQs before canceling work to prevent further queuing and ensure safe resource cleanup.

Impact

The vulnerability could lead to a use-after-free condition in kernel space, potentially causing system instability or crashes. However, no known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel version with the lp8788-charger driver.

Summary

CVE-2026-89468 addresses a use-after-free vulnerability in the Linux kernel's lp8788-charger driver. The function lp8788_charger_remove() originally flushed charger_work before unregistering IRQs, allowing an IRQ thread to queue charger_work after flush_work() returned. This work could run after the device resources (pchg) were freed, causing a use-after-free in lp8788_charger_event(). The fix changes the order to unregister IRQs first using free_irq(), which waits for any running threaded handler and prevents further queuing, followed by cancel_work_sync() to cancel or wait for any pending work. This vulnerability was discovered via an in-house static analysis tool and has been fixed in several Linux kernel commits.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 19:46 UTC

Technical details

References

Community reviews

Related threats