The Linux kernel power supply driver for rt9455 had a vulnerability where the threaded IRQ handler could queue delayed work items (pwr_rdy_work, max_charging_time_work, batt_presence_work) that reference rt9455_info. During teardown (rt9455_remove) or probe error paths, these works were not always properly canceled before rt9455_info was freed. Specifically, batt_presence_work could requeue max_charging_time_work after it was canceled, and the IRQ remained registered until devres cleanup, allowing further queuing of work. This led to potential use-after-free when delayed work callbacks accessed freed rt9455_info. The fix registers a cancellation function via devm_add_action_or_reset to drain all delayed works in the correct order after the IRQ is freed and before freeing rt9455_info, preventing use-after-free.

If exploited, this vulnerability could cause use-after-free conditions in kernel space, potentially leading to kernel crashes or undefined behavior. However, no known exploits in the wild have been reported. The impact is limited to systems using the rt9455 power supply driver in the Linux kernel.

A fix has been implemented in the Linux kernel source to properly cancel and drain delayed work items before freeing associated data structures. Users should update to the fixed kernel version containing this patch. No additional mitigation is required beyond applying the official fix.