CVE-2026-89468power: supply: lp8788-charger: fix use-after-free on remove
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788_charger_remove() flushes charger_work before unregistering the IRQs. An IRQ thread can queue charger_work after flush_work() has returned. The work can then run after devres frees pchg and dereference it in lp8788_charger_event(). Unregister the IRQs first. free_irq() waits for any running threaded handler, so no handler can queue more work afterwards. Then use cancel_work_sync() to cancel pending work or wait for running work to finish. This issue was found by an in-house static analysis tool.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 98a2766493589c18c327ae3dad5243b53fcb5f70 builds before 88d8eadfad5d9ff967e74090152940bcfa27df69; from 98a2766493589c18c327ae3dad5243b53fcb5f70 before b3aa1e9509e1b0a863353356d617fb45d1b6250a; from 98a2766493589c18c327ae3dad5243b53fcb5f70 before b4eb6a056b441ba0caedfbfc42cec501acf12f67; from 98a2766493589c18c327ae3dad5243b53fcb5f70 before 831c29a12d560f8a3225f43050b3fbb5dfd79c66 | CNA record |
References
- https://git.kernel.org/stable/c/88d8eadfad5d9ff967e74090152940bcfa27df69
- https://git.kernel.org/stable/c/b3aa1e9509e1b0a863353356d617fb45d1b6250a
- https://git.kernel.org/stable/c/b4eb6a056b441ba0caedfbfc42cec501acf12f67
- https://git.kernel.org/stable/c/831c29a12d560f8a3225f43050b3fbb5dfd79c66
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.