VulnerabilityPublished 11 Sep 2026Updated 30 Oct 2026

CVE-2026-89475: Linux kernel · power: supply: bq24257: fix use-after-free on remove

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f495808cdd6d9576965787cf6d9737d0b0e86b73 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 13:05 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in f495808cdd6d9576965787cf6d9737d0b0e86b73, a279e64c907f5638bb34cb8e2c9285798cf5f690, 861ec73ce86e2ca18082cc7be4f140a5bbdf1428 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 2219a935963e5eeb19e5abfb99475fcc06bbb804, < f495808cdd6d9576965787cf6d9737d0b0e86b73	Fixed in f495808cdd6d9576965787cf6d9737d0b0e86b73
LinuxLinux	Affected ≥ 2219a935963e5eeb19e5abfb99475fcc06bbb804, < a279e64c907f5638bb34cb8e2c9285798cf5f690	Fixed in a279e64c907f5638bb34cb8e2c9285798cf5f690
LinuxLinux	Affected ≥ 2219a935963e5eeb19e5abfb99475fcc06bbb804, < 861ec73ce86e2ca18082cc7be4f140a5bbdf1428	Fixed in 861ec73ce86e2ca18082cc7be4f140a5bbdf1428
LinuxLinux	Affected ≥ 2219a935963e5eeb19e5abfb99475fcc06bbb804, < 47ccbad210f48721c30d69d65b83dc9fff919ca9	Fixed in 47ccbad210f48721c30d69d65b83dc9fff919ca9
LinuxLinux	Affected ≥ 2219a935963e5eeb19e5abfb99475fcc06bbb804, < 9d77fd7dd9a3ad57f7655c5264b503b85adbb7b8	Fixed in 9d77fd7dd9a3ad57f7655c5264b503b85adbb7b8
LinuxLinux	Affected ≥ 2219a935963e5eeb19e5abfb99475fcc06bbb804, < 9d34c9d660c3d0931d2cc749c46c47cf31f96e48	Fixed in 9d34c9d660c3d0931d2cc749c46c47cf31f96e48

AI-suggested

A fix is available and has been applied in multiple Linux kernel commits. Users should update to a Linux kernel version that includes these fixes to remediate the vulnerability. No additional mitigation steps are required beyond applying the official patch.

Description

A use-after-free vulnerability was identified and fixed in the Linux kernel's power supply driver for the bq24257 device. The issue involved a delayed work handler that could access freed memory after device removal due to improper management of interrupt and work cancellation. The fix involved making the delayed work device-managed to ensure proper cancellation and ordering of resource release during device removal.

Impact

The vulnerability could lead to use-after-free conditions causing kernel memory corruption or crashes when the device is removed. This can affect system stability and potentially lead to denial of service. There is no indication of exploitation in the wild or direct privilege escalation from this flaw.

Summary

CVE-2026-89475 addresses a use-after-free vulnerability in the Linux kernel power supply driver for the bq24257 device. The STAT-pin interrupt is managed by devm and remains armed until devm cleanup after the remove() function returns. However, remove() cancels the iilimit_setup_work while the threaded interrupt handler can still fire and reschedule this work, leading to dereferencing of freed memory. The fix changes the delayed work to be device-managed with devm_delayed_work_autocancel(), ensuring the interrupt is released before the work is canceled and the device memory freed. This prevents the handler from rescheduling work after the device is removed. The explicit cancel_delayed_work_sync() call in remove() was removed as it became unnecessary. The vulnerability was found by static analysis and fixed in several commits.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 13:05 UTC

Technical details

References

Community reviews

Related threats