CVE-2026-90394

power: supply: sc2731_charger: cancel work on remove

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: sc2731_charger: cancel work on remove

The USB notifier and initial charger detection can schedule info->work. The remove path unregisters the notifier, but does not cancel queued or running work before the devm-allocated driver data is released.

Set the platform drvdata used by remove, then cancel the work after unregistering the notifier.

This issue was found by a static analysis tool.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before bb74a5ab30963022981381ea6aee176fd0c7957cAffected 8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before 232e9e946b496e4706e2f34ce4a617460d8ae713Affected 8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before 05c188addc6d1af51e28496e95096f4df9a000e9Affected 8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before 972d88069050d0272b776145b824198b8f899dceAffected 8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before c6df6e0c099086bc553d44410015cc81795070e6Affected 8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before d5266b4c5c77152e386a3a2d9d5244b3b6cbd57aAffected 8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before aab9d81a415c6653b44b057695ebfbba34dc9556Affected 8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before dfc859bb8d332c525872f1a44028137724fa1998Affected
LinuxLinux	5.0Affected before 5.0Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before bb74a5ab30963022981381ea6aee176fd0c7957cAffected
8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before 232e9e946b496e4706e2f34ce4a617460d8ae713Affected
8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before 05c188addc6d1af51e28496e95096f4df9a000e9Affected
8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before 972d88069050d0272b776145b824198b8f899dceAffected
8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before c6df6e0c099086bc553d44410015cc81795070e6Affected
8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before d5266b4c5c77152e386a3a2d9d5244b3b6cbd57aAffected
8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before aab9d81a415c6653b44b057695ebfbba34dc9556Affected
8ac1091ed18b4a6cb0dc2cd5653f080736f89392 to before dfc859bb8d332c525872f1a44028137724fa1998Affected

LinuxLinux

5.0Affected
before 5.0Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.