CVE-2026-89468 Linux Kernel CVE debrief

Who should care

Linux system administrators and developers using the lp8788-charger power supply driver should assess exposure and apply the patch to prevent potential crashes. They should also verify patch application, monitor system logs for signs of exploitation, and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

A use-after-free vulnerability in the Linux kernel's lp8788-charger power supply driver could lead to system crashes. Linux system administrators and developers should assess exposure, apply the patch, and monitor system logs.

• Potential system crash due to use-after-free vulnerability
• Need to verify patch application and system exposure
• Possible impact on system reliability and availability

Technical summary

The lp8788_charger_remove() function was not properly synchronizing the charger_work, leading to a use-after-free vulnerability. An IRQ thread could queue charger_work after flush_work() returned, causing a crash when the work ran after devres freed pchg. The issue was resolved by unregistering the IRQs first and then using cancel_work_sync() to cancel pending work or wait for running work to finish. This fix ensures that no handler can queue more work after the IRQs are unregistered, preventing the use-after-free vulnerability.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the affected Linux kernel versions
• Inventory Linux systems using the lp8788-charger power supply driver to identify potential exposure
• Monitor system logs for signs of exploitation
• Verify patch application and system exposure
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was found by an in-house static analysis tool. The issue was resolved by unregistering the IRQs first and then using cancel_work_sync() to cancel pending work or wait for running work to finish. The patch was applied to resolve the use-after-free vulnerability in the lp8788-charger power supply driver. The CVE record was published on 2026-09-11T20:19:27.910Z and has not been modified since then. The source of the issue is confirmed, but the full scope of affected systems and potential impact is still under review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.