CVE-2026-89472

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs charger_manager_remove() and the err_reg_extcon probe error path free each charger regulator with regulator_put() before tearing down the power_supply sysfs entries (power_supply_unregister()). charger_manager_remove() also calls try_charger_enable(cm, false) after the regulator_put() loop. A concurrent write to a charger's externally_control sysfs attribute that lands between regulator_put() and power_supply_unregister() can run charger_externally_control_store() and call try_charger_enable(), which, when charging is enabled, dereferences the already-freed consumer handle. When charging is enabled, try_charger_enable(cm, false) in .remove() also dereferences the freed handles directly. Both leave use-after-free windows. Symmetrically, probe registers the sysfs entries (power_supply_register) before acquiring the regulators (regulator_get, inside charger_manager_register_extcon), so userspace can reach externally_control before the regulators are available. Split charger_manager_register_extcon() on the sync/async boundary: charger_manager_get_regulators() (regulator_get only, no async producer) now runs before power_supply_register() so sysfs is not live before regulators are available, and charger_manager_register_extcon() keeps only the extcon notifier/work setup, still after power_supply_register() so a power_supply_register() failure cannot reach extcon setup. This keeps the sysfs setup/teardown ordering symmetric without introducing an asynchronous producer on the earlier probe-error path. Move power_supply_unregister() and try_charger_enable(cm, false) ahead of the regulator_put() loop on both teardown paths, and adjust err_reg_extcon (power_supply_unregister() then fall through err_regulator for regulator_put(); get_regulators self-rolls back on its own failure). This does not address the separate extcon-notifier-driven deref of the same handles, which needs its own synchronization design. Found by an in-house static analysis tool.

• https://git.kernel.org/stable/c/6d532582ff3c420598f02945b13184c738cc1581
• https://git.kernel.org/stable/c/86e4fa65368f3bbb506dddba8c9eedc75bd603b2
• https://git.kernel.org/stable/c/af3ce383ba0d0d48957a22ac7058ff5698775898
• https://git.kernel.org/stable/c/c57cb36f76eb7ced45f57af1a890d8f3a6d76342

Published

Sep 11, 2026

Last Modified

Sep 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89467In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89468In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89469In the Linux kernel, the following vulnerability has been re…8.4
• CVE-2026-8947Use-after-free in the DOM: Bindings (WebIDL) component. This…7.3
• CVE-2026-89470In the Linux kernel, the following vulnerability has been re…8.4
• CVE-2026-89471In the Linux kernel, the following vulnerability has been re…8.4
• CVE-2026-89473In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89474In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89475In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89476In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-89477In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-89478In the Linux kernel, the following vulnerability has been re…9.8