CVE-2026-89464

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: twl4030_charger: cancel workers via devm

bci is devm-allocated. Two workers (bci->work and bci->current_worker)

dereference it. twl4030_bci_remove() disables charging and masks

interrupts. It cancels neither worker. A worker pending at remove() can

run after devm frees bci.

The USB transceiver comes from devm_usb_get_phy_by_node(). devm

unregisters its notifier only after remove() returns. A cancel_work_sync()

in remove() can then race a notifier reschedule. devm_work_autocancel()

and devm_delayed_work_autocancel() avoid that. They cancel the workers

during devm release, before bci is freed.

The current_worker is registered first, since devm will cancel in

reverse order and bci->work can reschedule current_worker.

[Move comment about order into the commit message]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References