UBUNTU-CVE-2026-89465: High severity ubuntu/linux-aws vulnerability

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwrrdywork, maxchargingtimework and battpresencework. pwrrdywork and battpresencework can also queue maxchargingtimework, while battpresencework can requeue itself. rt9455remove() cancels maxchargingtimework before battpresencework. The latter can therefore queue maxchargingtimework after it has already been cancelled: rt9455remove() workqueue cancel pwrrdywork cancel maxchargingtimework battpresencework queues maxchargingtimework cancel battpresencework return devres frees rt9455info maxchargingtimework dereferences rt9455info The IRQ also remains registered until devres cleanup and can queue more work after any of the cancellation calls. If rt9455hwinit() fails after the IRQ has been requested, probe returns without cancelling work that may already have been queued. A pending callback can then access rt9455info after it has been freed. Register rt9455cancelalldelayedworks() through devmaddactionorreset() right after devmpowersupplyregister(). devres invokes the action in reverse registration order, after the managed IRQ has been freed and before rt9455info is released, so the delayed works are drained in both rt9455remove() and the probe error path. Cancel pwrrdywork and battpresencework before maxchargingtimework because both can queue the latter. This issue was found by an in-house static analysis tool.