CVE-2026-90394: power: supply: sc2731_charger: cancel work on remove
In the Linux kernel, the following vulnerability has been resolved:
power: supply: sc2731charger: cancel work on remove
The USB notifier and initial charger detection can schedule info->work. The remove path unregisters the notifier, but does not cancel queued or running work before the devm-allocated driver data is released.
Set the platform drvdata used by remove, then cancel the work after unregistering the notifier.
This issue was found by a static analysis tool.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The SC2731 charger driver must be removed while work previously scheduled by the USB notifier or initial charger detection is queued or running. The vulnerable remove path unregisters the notifier but does not cancel that work before devm-managed driver data is released.
Which systems are exposed?
Systems using the Linux kernel SC2731 charger driver are relevant. The provided information does not identify affected kernel versions, configurations, or hardware platforms beyond that driver.
What is the mitigation if the applicable kernel update cannot be deployed immediately?
The provided fix cancels the driver's work after unregistering the USB notifier during device removal. No alternative configuration workaround is specified in the provided information.
How can I verify that the fix is present?
Check whether the SC2731 charger driver's remove path sets the platform drvdata used by remove and cancels info->work after unregistering the notifier. The supplied stable-kernel references identify commits containing the resolution.