CVE-2026-89468

In the Linux kernel, the following vulnerability has been resolved:

power: supply: lp8788-charger: fix use-after-free on remove

lp8788 charger remove() flushes charger work before unregistering the IRQs. An IRQ thread can queue charger work after flush work() has returned. The work can then run after devres frees pchg and dereference it in lp8788 charger event().

Unregister the IRQs first. free irq() waits for any running threaded handler, so no handler can queue more work afterwards. Then use cancel work sync() to cancel pending work or wait for running work to finish.

This issue was found by an in-house static analysis tool.