CVE-2026-89465

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89465", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.709Z", "datePublished": "2026-09-11T19:43:25.950Z", "dateUpdated": "2026-10-30T12:31:47.294Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:31:47.294Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: rt9455: quiesce delayed work before teardown\n\nThe threaded IRQ handler can queue pwr_rdy_work,\nmax_charging_time_work and batt_presence_work. pwr_rdy_work and\nbatt_presence_work can also queue max_charging_time_work, while\nbatt_presence_work can requeue itself.\n\nrt9455_remove() cancels max_charging_time_work before\nbatt_presence_work. The latter can therefore queue\nmax_charging_time_work after it has already been cancelled:\n\n rt9455_remove() workqueue\n cancel pwr_rdy_work\n cancel max_charging_time_work\n batt_presence_work queues\n max_charging_time_work\n cancel batt_presence_work\n return\n devres frees rt9455_info\n max_charging_time_work dereferences\n rt9455_info\n\nThe IRQ also remains registered until devres cleanup and can queue more\nwork after any of the cancellation calls. If rt9455_hw_init() fails\nafter the IRQ has been requested, probe returns without cancelling work\nthat may already have been queued. A pending callback can then access\nrt9455_info after it has been freed.\n\nRegister rt9455_cancel_all_delayed_works() through\ndevm_add_action_or_reset() right after devm_power_supply_register().\ndevres invokes the action in reverse registration order, after the\nmanaged IRQ has been freed and before rt9455_info is released, so the\ndelayed works are drained in both rt9455_remove() and the probe error\npath. Cancel pwr_rdy_work and batt_presence_work before\nmax_charging_time_work because both can queue the latter.\n\nThis issue was found by an in-house static analysis tool."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached only when the I2C RT9455 charger is torn down locally (sysfs unbind, rmmod, or shutdown/reboot) so delayed work runs after rt9455_info is freed; charger IRQs come from the on-chip GPIO, not from any network protocol.\nAC:L - The attacker controls both sides of the race: they start teardown while USB plug/unplug IRQs or already-queued pwr_rdy_work/batt_presence_work (1s/60s, self-requeue) re-arm work after cancel; the delayed callbacks make the UAF window reliable, not layout-dependent.\nPR:N - On battery-powered devices with this IC, brief physical possession is enough to force power-off/reboot with no Linux account while charger IRQs fire during remove, as for the prior RT9455 teardown UAF (CVE-2026-46270); CAP_SYS_ADMIN unbind is only an alternate path.\nUI:N - No victim action is required; the attacker performs teardown and any charging-port manipulation themselves, without the victim opening files, mounting filesystems, or approving prompts.\nS:U - The UAF corrupts kernel heap inside the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Work callbacks container_of() a freed rt9455_info and then read client, regmap, and charger pointers, a classic use-after-free that yields arbitrary kernel reads after heap reuse.\nI:H - The same callbacks write through the freed object (queue_delayed_work, power_supply_changed, regmap_field_write), enabling heap-spray arbitrary writes and control-flow hijack.\nA:H - Use-after-free of driver private data from workqueue context causes a kernel oops or panic even when the UAF is not fully turned into a write primitive."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/supply/rt9455_charger.c"], "versions": [{"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "lessThan": "3def4721431f3e374e1e3124f4d32bb07ae8df1c", "status": "affected", "versionType": "git"}, {"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "lessThan": "c8645073876cbb1cdc8c2b995d093d08facfb187", "status": "affected", "versionType": "git"}, {"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "lessThan": "c09a2e4f8f101a44bd786a31696c958473469be0", "status": "affected", "versionType": "git"}, {"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "lessThan": "442c60c08ec23ac45da0a58877cab05e0a58f4ea", "status": "affected", "versionType": "git"}, {"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "lessThan": "df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02", "status": "affected", "versionType": "git"}, {"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "lessThan": "1b9978433c61a9b46e48832a1ebceee1cf5c9eb4", "status": "affected", "versionType": "git"}, {"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "lessThan": "7323e562f6961e4b7bce3225cde4ecbc78260deb", "status": "affected", "versionType": "git"}, {"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "lessThan": "3e7a1ebc32fad5a558254a478efd401c17a24381", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/supply/rt9455_charger.c"], "versions": [{"version": "4.2", "status": "affected"}, {"version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3def4721431f3e374e1e3124f4d32bb07ae8df1c"}, {"url": "https://git.kernel.org/stable/c/c8645073876cbb1cdc8c2b995d093d08facfb187"}, {"url": "https://git.kernel.org/stable/c/c09a2e4f8f101a44bd786a31696c958473469be0"}, {"url": "https://git.kernel.org/stable/c/442c60c08ec23ac45da0a58877cab05e0a58f4ea"}, {"url": "https://git.kernel.org/stable/c/df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02"}, {"url": "https://git.kernel.org/stable/c/1b9978433c61a9b46e48832a1ebceee1cf5c9eb4"}, {"url": "https://git.kernel.org/stable/c/7323e562f6961e4b7bce3225cde4ecbc78260deb"}, {"url": "https://git.kernel.org/stable/c/3e7a1ebc32fad5a558254a478efd401c17a24381"}], "title": "power: supply: rt9455: quiesce delayed work before teardown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/power/supply/rt9455_charger.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3def4721431f3e374e1e3124f4d32bb07ae8df1c", "status": "affected", "version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "versionType": "git"}, {"lessThan": "c8645073876cbb1cdc8c2b995d093d08facfb187", "status": "affected", "version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "versionType": "git"}, {"lessThan": "c09a2e4f8f101a44bd786a31696c958473469be0", "status": "affected", "version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "versionType": "git"}, {"lessThan": "442c60c08ec23ac45da0a58877cab05e0a58f4ea", "status": "affected", "version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "versionType": "git"}, {"lessThan": "df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02", "status": "affected", "version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "versionType": "git"}, {"lessThan": "1b9978433c61a9b46e48832a1ebceee1cf5c9eb4", "status": "affected", "version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "versionType": "git"}, {"lessThan": "7323e562f6961e4b7bce3225cde4ecbc78260deb", "status": "affected", "version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "versionType": "git"}, {"lessThan": "3e7a1ebc32fad5a558254a478efd401c17a24381", "status": "affected", "version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/power/supply/rt9455_charger.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: rt9455: quiesce delayed work before teardown\n\nThe threaded IRQ handler can queue pwr_rdy_work,\nmax_charging_time_work and batt_presence_work. pwr_rdy_work and\nbatt_presence_work can also queue max_charging_time_work, while\nbatt_presence_work can requeue itself.\n\nrt9455_remove() cancels max_charging_time_work before\nbatt_presence_work. The latter can therefore queue\nmax_charging_time_work after it has already been cancelled:\n\n rt9455_remove() workqueue\n cancel pwr_rdy_work\n cancel max_charging_time_work\n batt_presence_work queues\n max_charging_time_work\n cancel batt_presence_work\n return\n devres frees rt9455_info\n max_charging_time_work dereferences\n rt9455_info\n\nThe IRQ also remains registered until devres cleanup and can queue more\nwork after any of the cancellation calls. If rt9455_hw_init() fails\nafter the IRQ has been requested, probe returns without cancelling work\nthat may already have been queued. A pending callback can then access\nrt9455_info after it has been freed.\n\nRegister rt9455_cancel_all_delayed_works() through\ndevm_add_action_or_reset() right after devm_power_supply_register().\ndevres invokes the action in reverse registration order, after the\nmanaged IRQ has been freed and before rt9455_info is released, so the\ndelayed works are drained in both rt9455_remove() and the probe error\npath. Cancel pwr_rdy_work and batt_presence_work before\nmax_charging_time_work because both can queue the latter.\n\nThis issue was found by an in-house static analysis tool."}], "id": "CVE-2026-89465", "lastModified": "2026-10-30T13:20:16.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:27.533", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1b9978433c61a9b46e48832a1ebceee1cf5c9eb4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3def4721431f3e374e1e3124f4d32bb07ae8df1c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e7a1ebc32fad5a558254a478efd401c17a24381"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/442c60c08ec23ac45da0a58877cab05e0a58f4ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7323e562f6961e4b7bce3225cde4ecbc78260deb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c09a2e4f8f101a44bd786a31696c958473469be0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c8645073876cbb1cdc8c2b995d093d08facfb187"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Use-after-free in rt9455 power supply driver can lead to system crash or privilege escalation.", "id": "2532410", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532410"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel, specifically within the rt9455 power supply driver. This vulnerability occurs due to improper management of delayed tasks when the device is being removed or if its initialization fails. A pending task can attempt to access memory that has already been released, leading to a use-after-free condition. This could allow a local attacker to cause the system to crash, resulting in a Denial of Service, or potentially lead to privilege escalation."], "name": "CVE-2026-89465", "public_date": "2026-09-11T19:43:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89465\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89465\nhttps://git.kernel.org/stable/c/1b9978433c61a9b46e48832a1ebceee1cf5c9eb4\nhttps://git.kernel.org/stable/c/3e7a1ebc32fad5a558254a478efd401c17a24381\nhttps://git.kernel.org/stable/c/7323e562f6961e4b7bce3225cde4ecbc78260deb\nhttps://git.kernel.org/stable/c/df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,1b9978433c61a9b46e48832a1ebceee1cf5c9eb4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,7323e562f6961e4b7bce3225cde4ecbc78260deb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e86d69dd786e94046b8f5be7df1b9a8226a40b2a,3e7a1ebc32fad5a558254a478efd401c17a24381)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T19:00:08.845868+00:00", "updated": "2026-09-21T01:15:03.760459+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}