CVE-2026-89474

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

power: supply: bq256xx: drain usb_work before freeing the charger

The USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq->charger). The reset devm action only unregisters the notifier and was registered before the power supplies, so devm frees bq->charger on unwind before the action runs; a usb_work still queued can then dereference it.

Register the reset action after the power supplies, so it unregisters the notifiers and drains usb_work before the supplies are released. Initialize usb_work and obtain the PHY references before registering the notifiers, so the worker cannot run before the supplies exist.

Found by static analysis.

Affected product:

AlmaLinux 9.2 ESU , Debian 10 ELS , Debian 11 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU

Affected packages:

linux @ 5.10.259 (+4 more)

Live-patch status from KernelCare for each operating system.