{"id":21387,"date":"2026-09-12T04:31:07","date_gmt":"2026-09-11T20:31:07","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89465"},"modified":"2026-09-12T04:31:07","modified_gmt":"2026-09-11T20:31:07","slug":"cve-2026-89465","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89465","title":{"rendered":"CVE-2026-89465 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: rt9455"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>power: supply: rt9455: quiesce delayed work before teardown<\/p>\n<p>The threaded IRQ handler can queue pwr_rdy_work,<br \/>\nmax_charging_time_work and batt_presence_work.  pwr_rdy_work and<br \/>\nbatt_presence_work can also queue max_charging_time_work, while<br \/>\nbatt_presence_work can requeue itself.<\/p>\n<p>rt9455_remove() cancels max_charging_time_work before<br \/>\nbatt_presence_work.  The latter can therefore queue<br \/>\nmax_charging_time_work after it has already been cancelled:<\/p>\n<p>  rt9455_remove()                   workqueue<br \/>\n    cancel pwr_rdy_work<br \/>\n    cancel max_charging_time_work<br \/>\n                                      batt_presence_work queues<br \/>\n                                        max_charging_time_work<br \/>\n    cancel batt_presence_work<br \/>\n    return<br \/>\n    devres frees rt9455_info<br \/>\n                                      max_charging_time_work dereferences<br \/>\n                                        rt9455_info<\/p>\n<p>The IRQ also remains registered until devres cleanup and can queue more<br \/>\nwork after any of the cancellation calls.  If rt9455_hw_init() fails<br \/>\nafter the IRQ has been requested, probe returns without cancelling work<br \/>\nthat may already have been queued.  A pending callback can then access<br \/>\nrt9455_info after it has been freed.<\/p>\n<p>Register rt9455_cancel_all_delayed_works() through<br \/>\ndevm_add_action_or_reset() right after devm_power_supply_register().<br \/>\ndevres invokes the action in reverse registration order, after the<br \/>\nmanaged IRQ has been freed and before rt9455_info is released, so the<br \/>\ndelayed works are drained in both rt9455_remove() and the probe error<br \/>\npath.  Cancel pwr_rdy_work and batt_presence_work before<br \/>\nmax_charging_time_work because both can queue the latter.<\/p>\n<p>This issue was found by an in-house static analysis tool.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>power: supply: rt9455: quiesce delayed work before teardown<\/p>\n<p>The threaded IRQ handler can queue pwr_rdy_work,<br \/>\nmax_charging_time_wor<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21387","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}