Riskcovery

CVE-2026-89464

power: supply: twl4030_charger: cancel workers via devm

State
Published
Severity
Not scored
Published
Sep 11, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: twl4030_charger: cancel workers via devm

bci is devm-allocated. Two workers (bci->work and bci->current_worker) dereference it. twl4030_bci_remove() disables charging and masks interrupts. It cancels neither worker. A worker pending at remove() can run after devm frees bci.

The USB transceiver comes from devm_usb_get_phy_by_node(). devm unregisters its notifier only after remove() returns. A cancel_work_sync() in remove() can then race a notifier reschedule. devm_work_autocancel() and devm_delayed_work_autocancel() avoid that. They cancel the workers during devm release, before bci is freed.

The current_worker is registered first, since devm will cancel in reverse order and bci->work can reschedule current_worker.

[Move comment about order into the commit message]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d6ccc442b12102414c1343f0adacaa8a1aaa516c to before 9644c96ef8646c65d46caa5139a6631e29b79d6cAffected
  • d6ccc442b12102414c1343f0adacaa8a1aaa516c to before e9fffe10bd791082263c1678f2f6cdd6d7b487e0Affected
  • d6ccc442b12102414c1343f0adacaa8a1aaa516c to before c46c205bab0dfce4dd54aeb49da3f183e1fdfc63Affected
  • d6ccc442b12102414c1343f0adacaa8a1aaa516c to before 72a2d6cd049f892853e4e2d8d8fc5e7d0244a458Affected
  • d6ccc442b12102414c1343f0adacaa8a1aaa516c to before a4460e89d4088cfec2da5be33e265ef1a8e780e9Affected
  • d6ccc442b12102414c1343f0adacaa8a1aaa516c to before b955da82db4170bdf1c784dc457287aa0c977378Affected
  • d6ccc442b12102414c1343f0adacaa8a1aaa516c to before 6eba34732524067da2aad5ddfdfbc641ded10e9eAffected
LinuxLinux
  • 2.6.39Affected
  • before 2.6.39Not affected
  • 5.15.221 through 5.15.*Not affected
  • 6.1.188 through 6.1.*Not affected
  • 6.6.157 through 6.6.*Not affected
  • 6.12.109 through 6.12.*Not affected
  • 6.18.50 through 6.18.*Not affected
  • 7.2.4 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.