From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6B4B4CCDE3 for ; Fri, 11 Sep 2026 19:51:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156290; cv=none; b=ocHwB51M8lm2JvNqgqYu1LjSMTCHr1S9+HfQkDI8eseW3MmBRdfnsBfsE/a8782gohX8cTeHNygUpzJhgXDU6xU5Q4aE/JdFLUiM4KAkmpGe6amf8+FG+U+46YATmS+tMxT/sfrCcuDqpBi4nCc2XRdGdaRFgULnlQBNqwwKAD0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156290; c=relaxed/simple; bh=Ty1mWjcnVgK0Nvbb/0vaOLMdWTvXYiYBLscsr8kr4l0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=E7aQh4Oy2pKyJ0xhBRWYAUVTgneG4AFta58ohURo1NvnOuFmnab35aKb4O4eZ0Km28FGYJVQDwqmtdtd8iIqkZqXSm7MIYEpuTjMr+BEsLIltizqhj4/qnD3fH+uS2T0EkuMysykMMYudiQDnqqB1Z/UHlVuoTp3g+Prj/TjCGY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=M3DpFWDA; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="M3DpFWDA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9455D1F0089D; Fri, 11 Sep 2026 19:51:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156284; bh=BS2vQUKfony3xKSGU0/7ZmLOqUjeymioWMo3SDcwv58=; h=From:To:Cc:Subject:Date:Reply-To; b=M3DpFWDA+MM2G1nrJRUbGnu6oDpNoKBlw163bMThCbdppaueDDgJQ84qKEFoUZi1N 2K9qVTfZGJCk11k3UcUtc6gilFJeshhm1CK8S8nOKd7LwjaWC+CmAlFf12EHEBii0r w3CDI2XGweWSUfvWX1Y4Zd3vqWksvmAF0vy0AREU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89465: power: supply: rt9455: quiesce delayed work before teardown Date: Fri, 11 Sep 2026 21:42:34 +0200 Message-ID: <2026091102-CVE-2026-89465-731f@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3906; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=qGxlbqsHxgkut9/WW2th70/DFoZ0RoRJPKb4ZKLbryA=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIv0u24mkTngnqjL3cMpkvQ0vviudO6y5wFnl5TVW+ Rs1f1c87ohlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJ/OZmmGf9ZmZH/aGOvoqD LjGJO7Yc75K3/8Ywv1inKvpHi9hLwWj7ncuVppueUZnrAQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_work and batt_presence_work can also queue max_charging_time_work, while batt_presence_work can requeue itself. rt9455_remove() cancels max_charging_time_work before batt_presence_work. The latter can therefore queue max_charging_time_work after it has already been cancelled: rt9455_remove() workqueue cancel pwr_rdy_work cancel max_charging_time_work batt_presence_work queues max_charging_time_work cancel batt_presence_work return devres frees rt9455_info max_charging_time_work dereferences rt9455_info The IRQ also remains registered until devres cleanup and can queue more work after any of the cancellation calls. If rt9455_hw_init() fails after the IRQ has been requested, probe returns without cancelling work that may already have been queued. A pending callback can then access rt9455_info after it has been freed. Register rt9455_cancel_all_delayed_works() through devm_add_action_or_reset() right after devm_power_supply_register(). devres invokes the action in reverse registration order, after the managed IRQ has been freed and before rt9455_info is released, so the delayed works are drained in both rt9455_remove() and the probe error path. Cancel pwr_rdy_work and batt_presence_work before max_charging_time_work because both can queue the latter. This issue was found by an in-house static analysis tool. The Linux kernel CVE team has assigned CVE-2026-89465 to this issue. Affected and fixed versions =========================== Issue introduced in 4.2 with commit e86d69dd786e94046b8f5be7df1b9a8226a40b2a and fixed in 6.12.109 with commit df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02 Issue introduced in 4.2 with commit e86d69dd786e94046b8f5be7df1b9a8226a40b2a and fixed in 6.18.50 with commit 1b9978433c61a9b46e48832a1ebceee1cf5c9eb4 Issue introduced in 4.2 with commit e86d69dd786e94046b8f5be7df1b9a8226a40b2a and fixed in 7.2.4 with commit 7323e562f6961e4b7bce3225cde4ecbc78260deb Issue introduced in 4.2 with commit e86d69dd786e94046b8f5be7df1b9a8226a40b2a and fixed in 7.3-rc1 with commit 3e7a1ebc32fad5a558254a478efd401c17a24381 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89465 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/power/supply/rt9455_charger.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02 https://git.kernel.org/stable/c/1b9978433c61a9b46e48832a1ebceee1cf5c9eb4 https://git.kernel.org/stable/c/7323e562f6961e4b7bce3225cde4ecbc78260deb https://git.kernel.org/stable/c/3e7a1ebc32fad5a558254a478efd401c17a24381