CVE-2026-89797: power: supply: ab8500_fg: fix use-after-free on remove
In the Linux kernel, the following vulnerability has been resolved:
power: supply: ab8500fg: fix use-after-free on remove
ab8500fgremove() destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after ->remove() returns, so a handler that fires in that window queues work on the freed workqueue.
Tear the workqueue down through devm instead, registering its cleanup after the power supply and before the interrupt requests. devm then frees the interrupts first, so the handlers can no longer queue work, before disabling the delayed and plain work items and destroying the workqueue. Disabling the items, rather than cancelling them, keeps them disabled so no producer (including the power-supply externalpowerchanged callback) can requeue them.
Found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
For the Linux kernel power-supply ab8500_fg driver, tear down the workqueue through devm by registering its cleanup after the power supply and before the interrupt requests; this frees interrupts before disabling delayed and plain work items and destroying the workqueue. Disable the work items rather than cancelling them so producers, including the power-supply external_power_changed callback, cannot requeue them.
Event History
Frequently Asked Questions
When is this issue reachable?
The race occurs during removal of the ab8500_fg driver, when its workqueue is destroyed while threaded interrupt handlers remain armed. A handler firing in that interval can queue work to the already freed workqueue.
What conditions must be present for a system to be exposed?
The system must be using the ab8500_fg driver and undergo driver removal while its threaded interrupt handlers can still run. The supplied data does not identify affected kernel versions or a default configuration status.
How does the fix prevent work from being queued after teardown begins?
It makes workqueue cleanup device-managed and orders that cleanup so interrupt requests are freed before the workqueue is disabled and destroyed. It disables delayed and regular work items rather than merely cancelling them, preventing interrupt handlers or the external_power_changed callback from requeueing work.