CVE-2026-89473 Linux CVE debrief

Who should care

Linux kernel maintainers and users, particularly those using the bq25890 power supply driver, should assess their exposure and apply the fix to prevent potential reference leaks. This is crucial for maintaining the stability and security of systems utilizing the Linux kernel. Additionally, users of affected systems should verify their Linux kernel version and monitor system logs for any signs of issues related to the bq25890 driver.

Why it matters

CVE-2026-89473 is a vulnerability in the Linux kernel's power supply driver bq25890 that can lead to reference leaks if not properly addressed. Linux kernel maintainers and users should assess their exposure and apply the fix.

• Verify Linux kernel version and apply patch to prevent reference leaks.
• Monitor system logs for bq25890 driver issues.

Technical summary

The bq25890_fw_probe() function in the Linux kernel's power supply driver acquires a reference to a secondary charger but fails to release it in certain error scenarios or during driver detach. This can lead to reference leaks. The fix involves registering a device-managed cleanup action to release the secondary charger reference on probe failures and driver detach, preventing potential reference leaks and ensuring the stability of the system. Linux kernel maintainers and users should assess their exposure and apply the fix.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the bq25890 driver to prevent potential reference leaks.
• Verify that the Linux kernel version in use includes the fix for CVE-2026-89473.
• Monitor system logs for any signs of issues related to the bq25890 driver.
• Perform a thorough review of the Linux kernel's power supply driver code to identify similar issues.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The issue was found by code review. The fix involves registering a device-managed cleanup action to release the secondary charger reference on probe failures and driver detach. This approach ensures that the reference is properly released, preventing potential leaks. It is essential to verify the Linux kernel version and apply the patch to prevent reference leaks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.