CVE-2026-89465

In the Linux kernel, the following vulnerability has been resolved:

power: supply: rt9455: quiesce delayed work before teardown

The threaded IRQ handler can queue pwr rdy work, max charging time work and batt presence work. pwr rdy work and batt presence work can also queue max charging time work, while batt presence work can requeue itself.

rt9455 remove() cancels max charging time work before batt presence work. The latter can therefore queue max charging time work after it has already been cancelled:

rt9455 remove() workqueue cancel pwr rdy work cancel max charging time work batt presence work queues max charging time work cancel batt presence work return devres frees rt9455 info max charging time work dereferences rt9455 info

The IRQ also remains registered until devres cleanup and can queue more work after any of the cancellation calls. If rt9455 hw init() fails after the IRQ has been requested, probe returns without cancelling work that may already have been queued. A pending callback can then access rt9455 info after it has been freed.

Register rt9455 cancel all delayed works() through devm add action or reset() right after devm power supply register(). devres invokes the action in reverse registration order, after the managed IRQ has been freed and before rt9455 info is released, so the delayed works are drained in both rt9455 remove() and the probe error path. Cancel pwr rdy work and batt presence work before max charging time work because both can queue the latter.

This issue was found by an in-house static analysis tool.