CVE-2026-89467 power: supply: qcom_battmgr: fix use-after-free
A use-after-free in the Qualcomm battery manager driver allows local attackers to execute code or escalate privileges via race conditions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89467?
CVE-2026-89467 is an use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
power: supply: qcom_battmgr: fix use-after-free
qcom_battmgr_pdr_notify() queues enable_work when the PMIC GLINK service comes up, and the worker recovers battmgr through container_of() to issue firmware requests. The PMIC GLINK client stays on the client list until its devres release action runs, so a PDR notification can keep queueing the work, and a pending or running worker can access battmgr after devres frees it.
Make enable_work device-managed with devm_work_autocancel(), registered before the PMIC GLINK client is allocated. The devres cleanup then releases the client first, so no further notification can queue the work, and cancels the work before battmgr is freed.
This issue was found by an in-house static analysis tool.
Which versions are affected by CVE-2026-89467?
How do I fix CVE-2026-89467?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89467 being exploited?
There is no known exploitation of CVE-2026-89467 in the wild and no public exploit code.
Sources
Also known as AZL-100112, BELL-CVE-2026-89467, DEBIAN-CVE-2026-89467, GHSA-6hqf-cg9r-x89w, UBUNTU-CVE-2026-89467.