CVE-2026-89797 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
power: supply: ab8500_fg: fix use-after-free on remove
ab8500_fg_remove() destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after ->remove() returns, so a handler that fires in that window queues work on the freed workqueue.
Tear the workqueue down through devm instead, registering its cleanup after the power supply and before the interrupt requests. devm then frees the interrupts first, so the handlers can no longer queue work, before disabling the delayed and plain work items and destroying the workqueue. Disabling the items, rather than cancelling them, keeps them disabled so no producer (including the power-supply external_power_changed callback) can requeue them.
Found by an in-house static analysis tool.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within the Linux kernel's ab8500_fg driver represents a critical use-after-free condition that occurs during the device removal process. This flaw stems from an incorrect ordering of resource cleanup operations, specifically involving the interaction between devm-managed threaded interrupt handlers and a manually managed workqueue. In this scenario, the remove function is responsible for destroying the driver's workqueue to release associated memory resources. However, because the threaded interrupt handlers are allocated using device management (devm) mechanisms, their lifecycle extends beyond the execution of the remove callback. These handlers are only freed after the remove function returns control to the kernel core. Consequently, if an interrupt occurs in the narrow window between the destruction of the workqueue and the final freeing of the interrupt handler structures, the running thread attempts to queue a work item onto a memory address that has already been released back to the system allocator.
This race condition leads to undefined behavior with potentially severe consequences for system stability and security. When the threaded interrupt handler executes after the workqueue structure has been freed, it writes data into invalid memory space. Depending on how quickly the kernel reuses that specific memory region for other purposes, this can result in a general protection fault causing an immediate kernel panic or denial of service. More critically, if the attacker or malicious process can influence the timing to ensure the freed workqueue structure is reallocated for another purpose, such as executing arbitrary code or manipulating control flow structures, it could lead to privilege escalation or remote code execution vulnerabilities. The static analysis tool that detected this issue highlighted a classic synchronization error where resource lifecycles are not properly aligned with their dependencies.
The root cause lies in the mismatch between manual and automatic memory management strategies within the driver's teardown sequence. By manually destroying the workqueue while relying on devm for interrupt handler cleanup, the developer created a temporal gap where resources were accessed after being logically freed. The operational impact is significant as it compromises the reliability of power supply monitoring systems in devices utilizing the AB8500 fuel gauge chip. Any system undergoing driver unloading or device removal could crash if an interrupt fires during this specific window, making the vulnerability exploitable under conditions that trigger interrupts near module unload times or hotplug events.
To mitigate this vulnerability, the fix involves restructuring the cleanup sequence to ensure strict ordering of resource deallocation through devm mechanisms. The workqueue is now registered for automatic destruction via device management resources rather than being manually destroyed in the remove function. Crucially, the registration order ensures that the workqueue's cleanup callback is scheduled after the power supply subsystem but before the interrupt request teardown. This guarantees that when the kernel proceeds to free the devm-managed interrupts first, no new threads can be spawned by hardware events. Subsequently, existing delayed and plain work items are disabled rather than merely cancelled. Disabling these items prevents any producer, including external power change callbacks from re-queuing work onto a structure that is in the process of being destroyed. This approach aligns with CWE-416 (Use After Free) by eliminating the window where freed memory is accessed and adheres to ATT&CK techniques related to system exploitation through race conditions or improper resource handling, ensuring robust defense-in-depth for kernel-level drivers.