CVE-2026-89472: power: supply: charger-manager: register regulators before exposing sysfs
In the Linux kernel, the following vulnerability has been resolved:
power: supply: charger-manager: register regulators before exposing sysfs
chargermanagerremove() and the errregextcon probe error path free each charger regulator with regulatorput() before tearing down the powersupply sysfs entries (powersupplyunregister()). chargermanagerremove() also calls trychargerenable(cm, false) after the regulatorput() loop. A concurrent write to a charger's externallycontrol sysfs attribute that lands between regulatorput() and powersupplyunregister() can run chargerexternallycontrolstore() and call trychargerenable(), which, when charging is enabled, dereferences the already-freed consumer handle. When charging is enabled, trychargerenable(cm, false) in .remove() also dereferences the freed handles directly. Both leave use-after-free windows. Symmetrically, probe registers the sysfs entries (powersupplyregister) before acquiring the regulators (regulatorget, inside chargermanagerregisterextcon), so userspace can reach externallycontrol before the regulators are available.
Split chargermanagerregisterextcon() on the sync/async boundary: chargermanagergetregulators() (regulatorget only, no async producer) now runs before powersupplyregister() so sysfs is not live before regulators are available, and chargermanagerregisterextcon() keeps only the extcon notifier/work setup, still after powersupplyregister() so a powersupplyregister() failure cannot reach extcon setup. This keeps the sysfs setup/teardown ordering symmetric without introducing an asynchronous producer on the earlier probe-error path.
Move powersupplyunregister() and trychargerenable(cm, false) ahead of the regulatorput() loop on both teardown paths, and adjust errregextcon (powersupplyunregister() then fall through errregulator for regulatorput(); getregulators self-rolls back on its own failure).
This does not address the separate extcon-notifier-driven deref of the same handles, which needs its own synchronization design.
Found by an in-house static analysis tool.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel charger-manager component are exposed when a charger power supply exposes the externally_control sysfs attribute and userspace can write to it. The race is relevant during charger-manager removal, certain probe error handling, or before regulator acquisition completes during probe.
What must happen for the use-after-free to be triggered?
A write to a charger's externally_control sysfs attribute must reach charger_externally_control_store() after regulator consumer handles have been released but before the power-supply sysfs entries are removed. During removal, charging being enabled can also cause try_charger_enable(cm, false) to dereference released regulator handles directly.
Can this occur while the driver is being initialized?
Yes. The described probe ordering registers the power-supply sysfs entries before regulators are acquired, allowing userspace to access externally_control before the regulator handles are available.