CVE-2026-89464power: supply: twl4030_charger: cancel workers via devm
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030_charger: cancel workers via devm bci is devm-allocated. Two workers (bci->work and bci->current_worker) dereference it. twl4030_bci_remove() disables charging and masks interrupts. It cancels neither worker. A worker pending at remove() can run after devm frees bci. The USB transceiver comes from devm_usb_get_phy_by_node(). devm unregisters its notifier only after remove() returns. A cancel_work_sync() in remove() can then race a notifier reschedule. devm_work_autocancel() and devm_delayed_work_autocancel() avoid that. They cancel the workers during devm release, before bci is freed. The current_worker is registered first, since devm will cancel in reverse order and bci->work can reschedule current_worker. [Move comment about order into the commit message]
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d6ccc442b12102414c1343f0adacaa8a1aaa516c before 9644c96ef8646c65d46caa5139a6631e29b79d6c; from d6ccc442b12102414c1343f0adacaa8a1aaa516c before e9fffe10bd791082263c1678f2f6cdd6d7b487e0; from d6ccc442b12102414c1343f0adacaa8a1aaa516c before c46c205bab0dfce4dd54aeb49da3f183e1fdfc63; from d6ccc442b12102414c1343f0adacaa8a1aaa516c before 72a2d6cd049f892853e4e2d8d8fc5e7d0244a458; from d6ccc442b12102414c1343f0adacaa8a1aaa516c before a4460e89d4088cfec2da5be33e265ef1a8e780e9; from d6ccc442b12102414c1343f0adacaa8a1aaa516c before b955da82db4170bdf1c784dc457287aa0c977378; from d6ccc442b12102414c1343f0adacaa8a1aaa516c before 6eba34732524067da2aad5ddfdfbc641ded10e9e | CNA record |
References
- https://git.kernel.org/stable/c/9644c96ef8646c65d46caa5139a6631e29b79d6c
- https://git.kernel.org/stable/c/e9fffe10bd791082263c1678f2f6cdd6d7b487e0
- https://git.kernel.org/stable/c/c46c205bab0dfce4dd54aeb49da3f183e1fdfc63
- https://git.kernel.org/stable/c/72a2d6cd049f892853e4e2d8d8fc5e7d0244a458
- https://git.kernel.org/stable/c/a4460e89d4088cfec2da5be33e265ef1a8e780e9
- https://git.kernel.org/stable/c/b955da82db4170bdf1c784dc457287aa0c977378
- https://git.kernel.org/stable/c/6eba34732524067da2aad5ddfdfbc641ded10e9e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.