power: supply: lp8788-charger: fix use-after-free on remove (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.17 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788_charger_remove() flushes charger_work before unregistering the IRQs. An IRQ thread can queue charger_work after flush_work() has returned. The work can then run after devres frees pchg and dereference it in lp8788_charger_event(). Unregister the IRQs first. free_irq() waits for any running threaded handler, so no handler can queue more work afterwards. Then use cancel_work_sync() to cancel pending work or wait for running work to finish. This issue was found by an in-house static analysis tool.
References
- https://git.kernel.org/stable/c/8758fe39a993f86998c8071826150b8859902497
- https://git.kernel.org/stable/c/4e3d3923976a986cc3cf960d13f1264cea8a9bba
- https://git.kernel.org/stable/c/88d8eadfad5d9ff967e74090152940bcfa27df69
- https://git.kernel.org/stable/c/b3aa1e9509e1b0a863353356d617fb45d1b6250a
- https://git.kernel.org/stable/c/b4eb6a056b441ba0caedfbfc42cec501acf12f67
- https://git.kernel.org/stable/c/831c29a12d560f8a3225f43050b3fbb5dfd79c66
European references
- ENISA EUVD · EUVD-2026-76374
- GCVE · GCVE-0-2026-89468
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 98a2766493589c18c327ae3dad5243b53fcb5f70 < 8758fe39a993f86998c8071826150b8859902497 ; affected 98a2766493589c18c327ae3dad5243b53fcb5f70 < 4e3d3923976a986cc3cf960d13f1264cea8a9bba ; affected 98a2766493589c18c327ae3dad5243b53fcb5f70 < 88d8eadfad5d9ff967e74090152940bcfa27df69 ; affected 98a2766493589c18c327ae3dad5243b53fcb5f70 < b3aa1e9509e1b0a863353356d617fb45d1b6250a ; affected 98a2766493589c18c327ae3dad5243b53fcb5f70 < b4eb6a056b441ba0caedfbfc42cec501acf12f67 ; affected 98a2766493589c18c327ae3dad5243b53fcb5f70 < 831c29a12d560f8a3225f43050b3fbb5dfd79c66 |
| Linux · Linux | affected 3.7 ; unaffected 0 < 3.7 ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.109 ≤ 6.12.* ; unaffected 6.18.50 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |