CVE-2026-89474: power: supply: bq256xx: drain usb_work before freeing the charger
In the Linux kernel, the following vulnerability has been resolved:
power: supply: bq256xx: drain usbwork before freeing the charger
The USB-PHY notifier queues usbwork, whose handler calls powersupplychanged(bq->charger). The reset devm action only unregisters the notifier and was registered before the power supplies, so devm frees bq->charger on unwind before the action runs; a usbwork still queued can then dereference it.
Register the reset action after the power supplies, so it unregisters the notifiers and drains usbwork before the supplies are released. Initialize usbwork and obtain the PHY references before registering the notifiers, so the worker cannot run before the supplies exist.
Found by static analysis.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel bq256xx power-supply driver with USB-PHY notifier support are relevant. The unsafe condition occurs during driver unwind or teardown when a queued usb_work item remains after the charger power supply has been freed.
What timing is required for the fault to occur?
The USB-PHY notifier must queue usb_work, and the driver must then unwind or be removed before that work runs. The queued handler can call power_supply_changed using the freed bq->charger pointer.
How does the resolved change prevent the issue?
The reset action is registered after the power supplies so it can unregister notifiers and drain usb_work before those supplies are released. It also initializes usb_work and obtains PHY references before notifier registration, preventing the worker from running before the supplies exist.
Is there evidence of active exploitation or a reported runtime trigger?
No. The issue was found by static analysis, and the provided information does not report active exploitation or a specific observed runtime crash.