CVE-2026-89473: power: supply: bq25890: Fix power_supply reference leak
In the Linux kernel, the following vulnerability has been resolved:
power: supply: bq25890: Fix powersupply reference leak
bq25890fwprobe() acquires a reference to a secondary charger using powersupplygetbyname(), but the reference is not released on later probe failures or on driver detach.
In particular, failures after bq25890fwprobe() returns successfully, such as a failure in bq25890hwinit(), also leak the reference.
Register a device-managed cleanup action immediately after acquiring the secondary charger. This releases the reference on all subsequent probe failures and on driver detach.
Found by code review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the bq25890 driver so that after bq25890_fw_probe() acquires a secondary charger reference via power_supply_get_by_name(), it registers a device-managed cleanup action immediately to ensure the reference is released on later bq25890_fw_probe() probe failures (e.g., bq25890_hw_init() failure) and when the driver detaches. Title indicates: "power_supply reference leak".
Linux kernel power: supply: bq25890 driver Device-managed cleanup registration = Register a device-managed cleanup action immediately after acquiring the power_supply reference in bq25890_fw_probe() (release the reference on subsequent probe failures and on driver detach)
Event History
Frequently Asked Questions
Can the leaked reference persist after the driver is removed?
Yes. The reference to the secondary charger can remain leaked on driver detach as well as on subsequent probe failures.
Does the leak require the initial firmware probe step to fail?
No. It can occur when bq25890_fw_probe() succeeds but a later initialization step fails, including bq25890_hw_init().
What does the fix change to prevent the leak?
It registers a device-managed cleanup action immediately after acquiring the secondary charger reference. That cleanup releases the reference on later probe failures and when the driver is detached.