{"id":"CVE-2026-89464","state":"PUBLISHED","title":"power: supply: twl4030_charger: cancel workers via devm","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: twl4030_charger: cancel workers via devm\n\nbci is devm-allocated. Two workers (bci->work and bci->current_worker)\ndereference it. twl4030_bci_remove() disables charging and masks\ninterrupts. It cancels neither worker. A worker pending at remove() can\nrun after devm frees bci.\n\nThe USB transceiver comes from devm_usb_get_phy_by_node(). devm\nunregisters its notifier only after remove() returns. A cancel_work_sync()\nin remove() can then race a notifier reschedule. devm_work_autocancel()\nand devm_delayed_work_autocancel() avoid that. They cancel the workers\nduring devm release, before bci is freed.\n\nThe current_worker is registered first, since devm will cancel in\nreverse order and bci->work can reschedule current_worker.\n\n[Move comment about order into the commit message]","publishedAt":"2026-09-11T19:43:25.282Z","updatedAt":"2026-10-19T08:47:13.492Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"9644c96ef8646c65d46caa5139a6631e29b79d6c","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"e9fffe10bd791082263c1678f2f6cdd6d7b487e0","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"c46c205bab0dfce4dd54aeb49da3f183e1fdfc63","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"72a2d6cd049f892853e4e2d8d8fc5e7d0244a458","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"a4460e89d4088cfec2da5be33e265ef1a8e780e9","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"b955da82db4170bdf1c784dc457287aa0c977378","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"6eba34732524067da2aad5ddfdfbc641ded10e9e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/power/supply/twl4030_charger.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.39","versionType":"semver"},{"version":"5.15.221","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/power/supply/twl4030_charger.c"]}],"references":["https://git.kernel.org/stable/c/9644c96ef8646c65d46caa5139a6631e29b79d6c","https://git.kernel.org/stable/c/e9fffe10bd791082263c1678f2f6cdd6d7b487e0","https://git.kernel.org/stable/c/c46c205bab0dfce4dd54aeb49da3f183e1fdfc63","https://git.kernel.org/stable/c/72a2d6cd049f892853e4e2d8d8fc5e7d0244a458","https://git.kernel.org/stable/c/a4460e89d4088cfec2da5be33e265ef1a8e780e9","https://git.kernel.org/stable/c/b955da82db4170bdf1c784dc457287aa0c977378","https://git.kernel.org/stable/c/6eba34732524067da2aad5ddfdfbc641ded10e9e"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89464.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89464","state":"PUBLISHED","datePublished":"2026-09-11T19:43:25.282Z","dateUpdated":"2026-10-19T08:47:13.492Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.708Z"},"containers":{"cna":{"title":"power: supply: twl4030_charger: cancel workers via devm","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: twl4030_charger: cancel workers via devm\n\nbci is devm-allocated. Two workers (bci->work and bci->current_worker)\ndereference it. twl4030_bci_remove() disables charging and masks\ninterrupts. It cancels neither worker. A worker pending at remove() can\nrun after devm frees bci.\n\nThe USB transceiver comes from devm_usb_get_phy_by_node(). devm\nunregisters its notifier only after remove() returns. A cancel_work_sync()\nin remove() can then race a notifier reschedule. devm_work_autocancel()\nand devm_delayed_work_autocancel() avoid that. They cancel the workers\nduring devm release, before bci is freed.\n\nThe current_worker is registered first, since devm will cancel in\nreverse order and bci->work can reschedule current_worker.\n\n[Move comment about order into the commit message]"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"9644c96ef8646c65d46caa5139a6631e29b79d6c","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"e9fffe10bd791082263c1678f2f6cdd6d7b487e0","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"c46c205bab0dfce4dd54aeb49da3f183e1fdfc63","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"72a2d6cd049f892853e4e2d8d8fc5e7d0244a458","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"a4460e89d4088cfec2da5be33e265ef1a8e780e9","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"b955da82db4170bdf1c784dc457287aa0c977378","versionType":"git"},{"version":"d6ccc442b12102414c1343f0adacaa8a1aaa516c","status":"affected","lessThan":"6eba34732524067da2aad5ddfdfbc641ded10e9e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/power/supply/twl4030_charger.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.39","versionType":"semver"},{"version":"5.15.221","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/power/supply/twl4030_charger.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/9644c96ef8646c65d46caa5139a6631e29b79d6c"},{"url":"https://git.kernel.org/stable/c/e9fffe10bd791082263c1678f2f6cdd6d7b487e0"},{"url":"https://git.kernel.org/stable/c/c46c205bab0dfce4dd54aeb49da3f183e1fdfc63"},{"url":"https://git.kernel.org/stable/c/72a2d6cd049f892853e4e2d8d8fc5e7d0244a458"},{"url":"https://git.kernel.org/stable/c/a4460e89d4088cfec2da5be33e265ef1a8e780e9"},{"url":"https://git.kernel.org/stable/c/b955da82db4170bdf1c784dc457287aa0c977378"},{"url":"https://git.kernel.org/stable/c/6eba34732524067da2aad5ddfdfbc641ded10e9e"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T08:47:13.492Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}