CVE-2026-89475: power: supply: bq24257: fix use-after-free on remove
In the Linux kernel, the following vulnerability has been resolved:
power: supply: bq24257: fix use-after-free on remove
The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove() returns. remove() cancels bq->iilimitsetupwork while the threaded handler can still fire; that handler reschedules the work and dereferences bq, so the work runs against freed memory once devm frees bq.
Make the delayed work device-managed with devmdelayedworkautocancel(), registered before the interrupt request. The devm cleanup then releases the interrupt first, so the handler can no longer reschedule the work, and cancels the work before bq is freed. The explicit canceldelayedworksync() in remove() is no longer needed and is dropped.
Found by static analysis.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel bq24257 power-supply driver are exposed when the driver is removed while its STAT-pin interrupt and delayed input-current-limit setup work can race. The issue is tied to the driver removal path rather than normal steady-state operation.
What conditions are required to trigger the use-after-free?
The bq24257 device must be removed while the devm-managed STAT-pin threaded interrupt handler can still run. If that handler reschedules the delayed work after remove() has canceled it, the work can later dereference the freed driver state.
How can I tell whether the fix is present?
Check whether the bq24257 driver registers its delayed work with devm_delayed_work_autocancel() before requesting the STAT-pin interrupt. In the fixed implementation, remove() no longer explicitly calls cancel_delayed_work_sync() for iilimit_setup_work.
What can be done if the fix cannot be applied immediately?
Avoid removing or unbinding the affected bq24257 driver while the system is running, since the vulnerable race occurs during device removal. The provided data does not identify another mitigation.