CVE-2026-89797: power: supply: ab8500_fg: fix use-after-free on remove
In the Linux kernel, the following vulnerability has been resolved:
power: supply: ab8500fg: fix use-after-free on remove
ab8500fgremove() destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after ->remove() returns, so a handler that fires in that window queues work on the freed workqueue.
Tear the workqueue down through devm instead, registering its cleanup after the power supply and before the interrupt requests. devm then frees the interrupts first, so the handlers can no longer queue work, before disabling the delayed and plain work items and destroying the workqueue. Disabling the items, rather than cancelling them, keeps them disabled so no producer (including the power-supply externalpowerchanged callback) can requeue them.
Found by an in-house static analysis tool.
Affected Software
Event History
Frequently Asked Questions
When is this issue reachable?
The race occurs during removal of the ab8500_fg driver, when its workqueue is destroyed while threaded interrupt handlers remain armed. A handler firing in that interval can queue work to the already freed workqueue.
What conditions must be present for a system to be exposed?
The system must be using the ab8500_fg driver and undergo driver removal while its threaded interrupt handlers can still run. The supplied data does not identify affected kernel versions or a default configuration status.
How does the fix prevent work from being queued after teardown begins?
It makes workqueue cleanup device-managed and orders that cleanup so interrupt requests are freed before the workqueue is disabled and destroyed. It disables delayed and regular work items rather than merely cancelling them, preventing interrupt handlers or the external_power_changed callback from requeueing work.