CVE-2026-89472

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: charger-manager: register regulators before exposing sysfs

charger_manager_remove() and the err_reg_extcon probe error path free each

charger regulator with regulator_put() before tearing down the power_supply

sysfs entries (power_supply_unregister()). charger_manager_remove() also

calls try_charger_enable(cm, false) after the regulator_put() loop. A

concurrent write to a charger's externally_control sysfs attribute that

lands between regulator_put() and power_supply_unregister() can run

charger_externally_control_store() and call try_charger_enable(), which,

when charging is enabled, dereferences the already-freed consumer handle.

When charging is enabled, try_charger_enable(cm, false) in .remove() also

dereferences the freed handles directly. Both leave use-after-free windows.

Symmetrically, probe registers the sysfs entries (power_supply_register)

before acquiring the regulators (regulator_get, insi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References