CVE-2026-89473power: supply: bq25890: Fix power_supply reference leak
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power_supply reference leak bq25890_fw_probe() acquires a reference to a secondary charger using power_supply_get_by_name(), but the reference is not released on later probe failures or on driver detach. In particular, failures after bq25890_fw_probe() returns successfully, such as a failure in bq25890_hw_init(), also leak the reference. Register a device-managed cleanup action immediately after acquiring the secondary charger. This releases the reference on all subsequent probe failures and on driver detach. Found by code review.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d54bf877fd878ee45cbc88d399fb98b0b1c4484d before 976c10d883a02968f3f58be0cee499d1fd2ba68a; from d54bf877fd878ee45cbc88d399fb98b0b1c4484d before 81b558afda9321c1a70971a39071d156f3e26950; from d54bf877fd878ee45cbc88d399fb98b0b1c4484d before 238320ad029a3eedabb86286a28cab55bca629b9; from d54bf877fd878ee45cbc88d399fb98b0b1c4484d before 58f1025eca92734eadc063715b98f62538286468; from d54bf877fd878ee45cbc88d399fb98b0b1c4484d before 863c32a83e4235eb0cbf6106f2b124e645302156 | CNA record |
References
- https://git.kernel.org/stable/c/976c10d883a02968f3f58be0cee499d1fd2ba68a
- https://git.kernel.org/stable/c/81b558afda9321c1a70971a39071d156f3e26950
- https://git.kernel.org/stable/c/238320ad029a3eedabb86286a28cab55bca629b9
- https://git.kernel.org/stable/c/58f1025eca92734eadc063715b98f62538286468
- https://git.kernel.org/stable/c/863c32a83e4235eb0cbf6106f2b124e645302156
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.