---
cve: "CVE-2026-89468"
severity: "LOW"
cvss: 3.1
epss: "3.1%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-11 20:19:27"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-15T19:22:32+02:00"
---

# CVE-2026-89468

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

power: supply: lp8788-charger: fix use-after-free on remove

lp8788_charger_remove() flushes charger_work before unregistering the
IRQs. An IRQ thread can queue charger_work after flush_work() has
returned. The work can then run after devres frees pchg and dereference
it in lp8788_charger_event().

Unregister the IRQs first. free_irq() waits for any running threaded
handler, so no handler can queue more work afterwards. Then use
cancel_work_sync() to cancel pending work or wait for running work to
finish.

This issue was found by an in-house static analysis tool.

## Patch verfügbar (OSV)

- Kernel ≥ 6.12.109
- Kernel ≥ 6.18.50
- Kernel ≥ 7.2.4

## Referenzen

- <https://git.kernel.org/stable/c/831c29a12d560f8a3225f43050b3fbb5dfd79c66>
- <https://git.kernel.org/stable/c/88d8eadfad5d9ff967e74090152940bcfa27df69>
- <https://git.kernel.org/stable/c/b3aa1e9509e1b0a863353356d617fb45d1b6250a>
- <https://git.kernel.org/stable/c/b4eb6a056b441ba0caedfbfc42cec501acf12f67>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89468) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_