power: supply: bq256xx: drain usb_work before freeing the charger (Linux Linux)

CVE-2026-89474
Non disponible

En bref

Source
NVD
EPSS
EPSS 0.17 % · centile 7 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Received

Description

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb_work before freeing the charger The USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq->charger). The reset devm action only unregisters the notifier and was registered before the power supplies, so devm frees bq->charger on unwind before the action runs; a usb_work still queued can then dereference it. Register the reset action after the power supplies, so it unregisters the notifiers and drains usb_work before the supplies are released. Initialize usb_work and obtain the PHY references before registering the notifiers, so the worker cannot run before the supplies exist. Found by static analysis.

Références

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Linux · Linuxaffected 32e4978bb920d047fe5de3ea42d176f267c01f63 < 9dcfdf6c598301b278f0b3490eb2bf4f600524e2 ; affected 32e4978bb920d047fe5de3ea42d176f267c01f63 < fd08d4dbbec07a44f01b0ddb041912be0dc88f8c ; affected 32e4978bb920d047fe5de3ea42d176f267c01f63 < 2cfb59dc9df8b5ebdd95e3d874a7f4690cee2bc8 ; affected 32e4978bb920d047fe5de3ea42d176f267c01f63 < 9a467bd1e6811011026ad4c8de701b940d88a00c ; affected 32e4978bb920d047fe5de3ea42d176f267c01f63 < 9e1aba34df9a87d53460888e05718717c0f69343 ; affected 32e4978bb920d047fe5de3ea42d176f267c01f63 < c8addb842ae8dcf69c15fc976e33e3bd538a41d7
Linux · Linuxaffected 5.12 ; unaffected 0 < 5.12 ; unaffected 5.15.221 ≤ 5.15.* ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* ; unaffected 6.12.109 ≤ 6.12.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD