HIGH Introduced in 3.7
power ReleaseIrq UAF
CVE-2026-89469
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg->work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it. Free the IRQ first so the threaded handler is quiesced and can no longer queue work, then cancel the delayed work to drain the final generation. This issue was found by an in-house static analysis tool.
02KernelScan AI Analysis
Risk summary
A use-after-free in the LP8727 charger driver can be triggered during device removal when an interrupt re-arms delayed work after it has been cancelled but before the IRQ is freed. The freed device data is then dereferenced by the lingering work function. Exploitation requires root-level access to unbind the device or unload the module on hardware that has this specific charger IC, and depends on winning a narrow race window.
Vulnerability analysis
During device removal, the LP8727 charger driver cancels pending delayed work before freeing the interrupt handler. If a hardware interrupt arrives in the window between these two steps, the threaded interrupt handler re-arms the delayed work. Once removal finishes and the device's private data structure is freed by the managed-resource layer, the still-pending work function runs and dereferences the freed memory. The fix reverses the cleanup order: the interrupt is freed first so the threaded handler can no longer queue new work, and then the delayed work is cancelled to drain any final generation. This vulnerability is reachable only on systems with the LP8727 charger IC present and requires privileged access to trigger device unbind or module unload.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.7 | 5.10.270 | 1321a4e62471 |
| 6.1 | 3.7 | 6.1.188 | 035cc6bc4d41 |
| 6.6 | 3.7 | 6.6.157 | 6f0ce09d60a0 |
| 7.2 | 3.7 | 7.2.4 | 6ab3128292df |
| 6.12 | 3.7 | 6.12.109 | 80d4e40a85ba |
| mainline | 3.7 | 7.3-rc1 | ceb6ac43b0f5 |
| 5.15 | 3.7 | 5.15.221 | dc1dc2837f8e |
| 6.18 | 3.7 | 6.18.50 | ab6b1ad710be |
| cip/6.12 | 3.7 | 6.12.111-cip32 | 80d4e40a85ba |