CVE-2026-89467 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, affected system administrators, security teams, and vulnerability management teams should assess exposure and prioritize verification of affected versions and deployments, review Linux kernel source code and documentation for qcom_battmgr module, and verify affected versions and deployments.

Why it matters

A use-after-free vulnerability was found in the Linux kernel's qcom_battmgr module, allowing a PDR notification to keep queueing the work, and a pending or running worker can access battmgr after devres frees it.

• Verify affected versions and deployments
• Assess exposure and prioritize remediation
• Review Linux kernel source code and documentation for qcom_battmgr module

Technical summary

The qcom_battmgr_pdr_notify() function queues enable_work when the PMIC GLINK service comes up, and the worker recovers battmgr through container_of() to issue firmware requests. However, the PMIC GLINK client stays on the client list until its devres release action runs, allowing a PDR notification to keep queueing the work, and a pending or running worker can access battmgr after devres frees it.

Defensive priority

Linux kernel developers and maintainers should assess exposure and prioritize verification of affected versions and deployments.

Recommended defensive actions

• Review Linux kernel source code and documentation for qcom_battmgr module
• Verify affected versions and deployments
• Assess exposure and prioritize remediation
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The issue was found by an in-house static analysis tool. The CVE record and NVD entry provide limited information about the vulnerability. Linux kernel developers and maintainers should verify affected versions and deployments, assess exposure, and prioritize remediation. The qcom_battmgr_pdr_notify() function queues enable_work when the PMIC GLINK service comes up, and the worker recovers battmgr through container_of() to issue firmware requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.