CVE-2026-89469 in Linux
Summary
by MITRE • 09/12/2026
In the Linux kernel, the following vulnerability has been resolved:
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg->work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it.
Free the IRQ first so the threaded handler is quiesced and can no longer queue work, then cancel the delayed work to drain the final generation.
This issue was found by an in-house static analysis tool.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The identified vulnerability represents a classic use-after-free condition within the Linux kernel power supply driver for the lp8727 device, specifically located in the interrupt release routine known as lp8727_release_irq(). This flaw arises from an incorrect ordering of resource cleanup operations during the device removal process. The core issue stems from the interaction between the threaded IRQ handler and a scheduled delayed work item. In this driver architecture, the function lp8727_isr_func serves as the threaded interrupt service routine responsible for handling hardware interrupts. It is also the sole entity that arms pchg->work by invoking schedule_delayed_work(). The original implementation of lp8727_release_irq() attempted to clean up resources by first canceling the pending delayed work and subsequently freeing the IRQ line. This sequence creates a critical race condition window where an interrupt can be delivered after the cancellation request is issued but before the IRQ handler is fully disabled or quiesced.
When this race condition occurs, the threaded IRQ handler may execute concurrently with the cleanup process. Specifically, if an interrupt arrives during this narrow interval, the lp8727_isr_func function can re-arm pchg->work via schedule_delayed_work() even though the system is in the midst of tearing down the device context. Because the work item has been rescheduled or newly queued by the ISR, it remains active after the driver's remove routine returns control to the kernel core. The devm managed resource layer then proceeds to free the pchg structure associated with the power supply device. However, if lp8727_delayed_func is subsequently executed as a result of the re-armed work item, it will attempt to dereference pointers within the now-freed pchg structure. This access to freed memory constitutes a use-after-free vulnerability, which can lead to kernel crashes, data corruption, or potentially exploitable code execution scenarios depending on how the attacker controls the state of the freed memory region.
The operational impact of this vulnerability is significant for system stability and security. A successful exploitation could result in a denial of service through a kernel panic or oops, disrupting critical power management functions. Furthermore, use-after-free bugs are historically among the most dangerous vulnerabilities because they allow an attacker to manipulate heap metadata or overwrite function pointers if specific memory allocation patterns align favorably with the exploit conditions. Although this vulnerability was discovered using an in-house static analysis tool rather than through external fuzzing, it highlights a subtle concurrency bug that might evade standard dynamic testing due to its reliance on precise timing and interrupt latency characteristics typical of kernel-level race conditions. The flaw is particularly insidious because it involves asynchronous execution paths where the order of operations must be strictly enforced to maintain memory safety.
To mitigate this vulnerability, the fix implements a strict ordering constraint during resource deallocation. The corrected approach mandates that the IRQ line must be freed first using free_irq or equivalent kernel APIs before attempting to cancel any pending delayed work items. By freeing the IRQ early in the cleanup sequence, the system ensures that no new interrupts can trigger the threaded handler, thereby preventing lp8727_isr_func from re-arming pchg->work. Once the interrupt subsystem is fully quiesced and unable to queue additional work, the code then proceeds to cancel any existing delayed work items using cancel_delayed_work_sync or similar synchronization primitives. This ensures that all previously queued instances of lp8727_delayed_func are drained and completed before their associated memory structures are released. This sequence guarantees that no dangling references remain active when the devm layer frees the pchg structure, effectively eliminating the use-after-free condition.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, which describes situations where software uses an address in memory after it has been freed or reallocated. The underlying cause is rooted in improper resource management and lack of synchronization between asynchronous execution contexts, corresponding to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization Race Condition. In terms of the MITRE ATT&CK framework for enterprise security, this type of vulnerability can be leveraged during post-exploitation phases to escalate privileges or maintain persistence if an attacker has already achieved initial code execution within a context that allows triggering the driver removal path. The fix emphasizes the importance of adhering to strict resource acquisition and release ordering principles in kernel development, ensuring that dependent resources are dismantled in reverse order of their creation and dependency chains to prevent such race conditions.