{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89464","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.708Z","datePublished":"2026-09-11T19:43:25.282Z","dateUpdated":"2026-09-14T12:00:03.171Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-14T12:00:03.171Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: twl4030_charger: cancel workers via devm\n\nbci is devm-allocated. Two workers (bci->work and bci->current_worker)\ndereference it. twl4030_bci_remove() disables charging and masks\ninterrupts. It cancels neither worker. A worker pending at remove() can\nrun after devm frees bci.\n\nThe USB transceiver comes from devm_usb_get_phy_by_node(). devm\nunregisters its notifier only after remove() returns. A cancel_work_sync()\nin remove() can then race a notifier reschedule. devm_work_autocancel()\nand devm_delayed_work_autocancel() avoid that. They cancel the workers\nduring devm release, before bci is freed.\n\nThe current_worker is registered first, since devm will cancel in\nreverse order and bci->work can reschedule current_worker.\n\n[Move comment about order into the commit message]"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/power/supply/twl4030_charger.c"],"versions":[{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","lessThan":"9644c96ef8646c65d46caa5139a6631e29b79d6c","status":"affected","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","lessThan":"e9fffe10bd791082263c1678f2f6cdd6d7b487e0","status":"affected","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","lessThan":"c46c205bab0dfce4dd54aeb49da3f183e1fdfc63","status":"affected","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","lessThan":"72a2d6cd049f892853e4e2d8d8fc5e7d0244a458","status":"affected","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","lessThan":"a4460e89d4088cfec2da5be33e265ef1a8e780e9","status":"affected","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","lessThan":"b955da82db4170bdf1c784dc457287aa0c977378","status":"affected","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","lessThan":"6eba34732524067da2aad5ddfdfbc641ded10e9e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/power/supply/twl4030_charger.c"],"versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","status":"unaffected","versionType":"semver"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9644c96ef8646c65d46caa5139a6631e29b79d6c"},{"url":"https://git.kernel.org/stable/c/e9fffe10bd791082263c1678f2f6cdd6d7b487e0"},{"url":"https://git.kernel.org/stable/c/c46c205bab0dfce4dd54aeb49da3f183e1fdfc63"},{"url":"https://git.kernel.org/stable/c/72a2d6cd049f892853e4e2d8d8fc5e7d0244a458"},{"url":"https://git.kernel.org/stable/c/a4460e89d4088cfec2da5be33e265ef1a8e780e9"},{"url":"https://git.kernel.org/stable/c/b955da82db4170bdf1c784dc457287aa0c977378"},{"url":"https://git.kernel.org/stable/c/6eba34732524067da2aad5ddfdfbc641ded10e9e"}],"title":"power: supply: twl4030_charger: cancel workers via devm","x_generator":{"engine":"bippy-1.2.0"}}}}