CVE-2026-89472

In the Linux kernel, the following vulnerability has been resolved:

power: supply: charger-manager: register regulators before exposing sysfs

charger manager remove() and the err reg extcon probe error path free each charger regulator with regulator put() before tearing down the power supply sysfs entries (power supply unregister()). charger manager remove() also calls try charger enable(cm, false) after the regulator put() loop. A concurrent write to a charger's externally control sysfs attribute that lands between regulator put() and power supply unregister() can run charger externally control store() and call try charger enable(), which, when charging is enabled, dereferences the already-freed consumer handle. When charging is enabled, try charger enable(cm, false) in .remove() also dereferences the freed handles directly. Both leave use-after-free windows. Symmetrically, probe registers the sysfs entries (power supply register) before acquiring the regulators (regulator get, inside charger manager register extcon), so userspace can reach externally control before the regulators are available.

Split charger manager register extcon() on the sync/async boundary: charger manager get regulators() (regulator get only, no async producer) now runs before power supply register() so sysfs is not live before regulators are available, and charger manager register extcon() keeps only the extcon notifier/work setup, still after power supply register() so a power supply register() failure cannot reach extcon setup. This keeps the sysfs setup/teardown ordering symmetric without introducing an asynchronous producer on the earlier probe-error path.

Move power supply unregister() and try charger enable(cm, false) ahead of the regulator put() loop on both teardown paths, and adjust err reg extcon (power supply unregister() then fall through err regulator for regulator put(); get regulators self-rolls back on its own failure).

This does not address the separate extcon-notifier-driven deref of the same handles, which needs its own synchronization design.

Found by an in-house static analysis tool.