CVE-2026-89475 power: supply: bq24257: fix use-after-free on remove
A use-after-free in the bq24257 power supply driver allows local attackers to execute arbitrary code or escalate privileges via race conditions during device removal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89475?
CVE-2026-89475 is an use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
power: supply: bq24257: fix use-after-free on remove
The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove() returns. remove() cancels bq->iilimit_setup_work while the threaded handler can still fire; that handler reschedules the work and dereferences bq, so the work runs against freed memory once devm frees bq.
Make the delayed work device-managed with devm_delayed_work_autocancel(), registered before the interrupt request. The devm cleanup then releases the interrupt first, so the handler can no longer reschedule the work, and cancels the work before bq is freed. The explicit cancel_delayed_work_sync() in remove() is no longer needed and is dropped.
Found by static analysis.
Which versions are affected by CVE-2026-89475?
How do I fix CVE-2026-89475?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89475 being exploited?
There is no known exploitation of CVE-2026-89475 in the wild and no public exploit code.
Sources
Also known as AZL-100208, BELL-CVE-2026-89475, DEBIAN-CVE-2026-89475, GHSA-pg63-6v2p-p54j, UBUNTU-CVE-2026-89475.