CVE-2026-89467

power: supply: qcom_battmgr: fix use-after-free

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 21, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: qcom_battmgr: fix use-after-free

qcom_battmgr_pdr_notify() queues enable_work when the PMIC GLINK service comes up, and the worker recovers battmgr through container_of() to issue firmware requests. The PMIC GLINK client stays on the client list until its devres release action runs, so a PDR notification can keep queueing the work, and a pending or running worker can access battmgr after devres frees it.

Make enable_work device-managed with devm_work_autocancel(), registered before the PMIC GLINK client is allocated. The devres cleanup then releases the client first, so no further notification can queue the work, and cancels the work before battmgr is freed.

This issue was found by an in-house static analysis tool.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	29e8142b5623b5949587bcc4f591c4e6595c4aca to before 35964ed01e10b61a30066b0c568aa0e0e8fb6432Affected 29e8142b5623b5949587bcc4f591c4e6595c4aca to before 77fefca305db44b0edd3fcdb52d781771c1ce366Affected 29e8142b5623b5949587bcc4f591c4e6595c4aca to before 06618447029c6dddaa02f6e9528efe5dd49fc329Affected 29e8142b5623b5949587bcc4f591c4e6595c4aca to before 49fbcd3da2958159370d25dafbf736e654a4d59bAffected 29e8142b5623b5949587bcc4f591c4e6595c4aca to before 4e40befedfc8ed86f44e1f81df92d13c149c9f8dAffected
LinuxLinux	6.3Affected before 6.3Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

29e8142b5623b5949587bcc4f591c4e6595c4aca to before 35964ed01e10b61a30066b0c568aa0e0e8fb6432Affected
29e8142b5623b5949587bcc4f591c4e6595c4aca to before 77fefca305db44b0edd3fcdb52d781771c1ce366Affected
29e8142b5623b5949587bcc4f591c4e6595c4aca to before 06618447029c6dddaa02f6e9528efe5dd49fc329Affected
29e8142b5623b5949587bcc4f591c4e6595c4aca to before 49fbcd3da2958159370d25dafbf736e654a4d59bAffected
29e8142b5623b5949587bcc4f591c4e6595c4aca to before 4e40befedfc8ed86f44e1f81df92d13c149c9f8dAffected

LinuxLinux

6.3Affected
before 6.3Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.