CVE-2026-89464

In the Linux kernel, the following vulnerability has been resolved:

power: supply: twl4030 charger: cancel workers via devm

bci is devm-allocated. Two workers (bci->work and bci->current worker) dereference it. twl4030 bci remove() disables charging and masks interrupts. It cancels neither worker. A worker pending at remove() can run after devm frees bci.

The USB transceiver comes from devm usb get phy by node(). devm unregisters its notifier only after remove() returns. A cancel work sync() in remove() can then race a notifier reschedule. devm work autocancel() and devm delayed work autocancel() avoid that. They cancel the workers during devm release, before bci is freed.

The current worker is registered first, since devm will cancel in reverse order and bci->work can reschedule current worker.

[Move comment about order into the commit message]