CVE-2026-89472 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should be aware of this vulnerability and take steps to address it. Specifically, Linux kernel developers and maintainers should review and apply the provided patches to the Linux kernel. Linux distribution maintainers should ensure that the charger-manager is properly configured and monitored to prevent exploitation. Users of Linux-based systems, such

Why it matters

A use-after-free vulnerability in the Linux kernel's charger-manager can lead to a crash or potentially allow attackers to execute arbitrary code if they can trigger the vulnerability. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should be aware of this vulnerability and take steps to address it.

• Verify the Linux kernel version and ensure it is patched to address the vulnerability.
• Monitor sysfs entries for suspicious activity.
• Implement additional security measures to restrict access to the sysfs entries.

Technical summary

The Linux kernel's charger-manager has a use-after-free vulnerability due to improper handling of regulator and power supply registration and deregistration. This can lead to a crash or potentially allow attackers to execute arbitrary code if they can trigger the vulnerability. The charger-manager registers regulators after exposing sysfs entries, allowing concurrent writes to the externally_control sysfs attribute to access already-freed consumer handles. To address this, split charger_manager_register_extcon() on the sync/async boundary, moving power_supply_unregister() and try_charger_enable(cm, false) ahead of the regulator_put() loop on both teardown paths.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel to address the use-after-free vulnerability.
• Ensure that the charger-manager is properly configured and monitored to prevent exploitation.
• Consider implementing additional security measures, such as SELinux or AppArmor, to restrict access to the sysfs entries.
• Verify the Linux kernel version and ensure it is patched to address the vulnerability.
• Monitor sysfs entries for suspicious activity.
• Implement additional security measures to restrict access to the sysfs entries.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and associated references provide details on the vulnerability, including its description, affected components, and potential impact. However, there is limited information on the actual exploitation of the vulnerability or the existence of any publicly available exploits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.