CVE-2026-89474 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the bq256xx charger should assess exposure and apply patches. They should verify Linux kernel versions and assess exposure for systems using the bq256xx charger. Additionally, they should review and apply patches for the Linux kernel.

Why it matters

This vulnerability in the Linux kernel's power supply bq256xx charger can cause issues if not properly patched. Linux kernel developers, maintainers, and users of Linux-based systems that utilize the bq256xx charger should assess exposure and apply patches.

• Verify Linux kernel versions for bq256xx charger usage to prevent potential crashes or hangs
• Assess exposure for systems using the bq256xx charger to prioritize patching

Technical summary

The Linux kernel vulnerability CVE-2026-89474 involves the power supply bq256xx charger. The USB-PHY notifier queues usb_work, which can dereference the charger after it has been freed. To address this, the reset devm action should be registered after the power supplies, ensuring that the notifiers are unregistered and usb_work is drained before the supplies are released. This vulnerability can cause issues if not properly patched. Linux kernel developers, maintainers, and users of Linux-based systems that utilize the bq256xx charger should assess exposure and apply patches.

Defensive priority

Verify Linux kernel versions and assess exposure for systems using the bq256xx charger.

Recommended defensive actions

• Verify Linux kernel versions for bq256xx charger usage
• Assess exposure for systems using the bq256xx charger
• Review and apply patches for the Linux kernel
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was found by static analysis of the Linux kernel code. The analysis revealed that the USB-PHY notifier queues usb_work, which can dereference the charger after it has been freed. The CVE record and NVD entry provide details on the issue and its resolution. Linux kernel developers and maintainers should verify the patch and assess exposure for systems using the bq256xx charger. The patch addresses the issue by registering the reset devm action after the power supplies, ensuring that the notifiers are unregistered and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.