CVE-2026-89472

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the charger-manager component of the power supply subsystem. The problem occurs because charger manager remove() and the err reg extcon probe error path release charger regulators using regulator put() before removing the power supply sysfs entries via power supply unregister(). A concurrent write to the externally control sysfs attribute can trigger charger externally control store() and subsequently try charger enable(), leading to a dereference of the already-freed consumer handle. Additionally, during the probe process, sysfs entries are registered via power supply register() before regulators are acquired through regulator get() inside charger manager register extcon(), allowing userspace to access externally control before regulators are available. The issue involves the following functions: charger manager remove(), power supply unregister(), try charger enable(), charger externally control store(), power supply register(), and charger manager register extcon().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.