{"id":"CVE-2026-89465","title":"power: supply: rt9455: quiesce delayed work before teardown","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: rt9455: quiesce delayed work before teardown\n\nThe threaded IRQ handler can queue pwr_rdy_work,\nmax_charging_time_work and batt_presence_work.  pwr_rdy_wo…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-825"],"vendor":"Linux","product":"Linux","affected":["Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < 442c60c08ec23ac45da0a58877cab05e0a58f4ea","Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02","Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < 1b9978433c61a9b46e48832a1ebceee1cf5c9eb4","Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < 7323e562f6961e4b7bce3225cde4ecbc78260deb","Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < 3e7a1ebc32fad5a558254a478efd401c17a24381","Linux 4.2"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:47:14.457Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89465","references":[{"url":"https://git.kernel.org/stable/c/442c60c08ec23ac45da0a58877cab05e0a58f4ea"},{"url":"https://git.kernel.org/stable/c/df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02"},{"url":"https://git.kernel.org/stable/c/1b9978433c61a9b46e48832a1ebceee1cf5c9eb4"},{"url":"https://git.kernel.org/stable/c/7323e562f6961e4b7bce3225cde4ecbc78260deb"},{"url":"https://git.kernel.org/stable/c/3e7a1ebc32fad5a558254a478efd401c17a24381"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89465.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89465"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532410"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89465"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89465"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89465.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00142,"epssPercentile":0.0345,"scores":{"cna":8.4,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.453Z","slug":"CVE-2026-89465","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: rt9455: quiesce delayed work before teardown\n\nThe threaded IRQ handler can queue pwr_rdy_work,\nmax_charging_time_work and batt_presence_work.  pwr_rdy_work and\nbatt_presence_work can also queue max_charging_time_work, while\nbatt_presence_work can requeue itself.\n\nrt9455_remove() cancels max_charging_time_work before\nbatt_presence_work.  The latter can therefore queue\nmax_charging_time_work after it has already been cancelled:\n\n  rt9455_remove()                   workqueue\n    cancel pwr_rdy_work\n    cancel max_charging_time_work\n                                      batt_presence_work queues\n                                        max_charging_time_work\n    cancel batt_presence_work\n    return\n    devres frees rt9455_info\n                                      max_charging_time_work dereferences\n                                        rt9455_info\n\nThe IRQ also remains registered until devres cleanup and can queue more\nwork after any of the cancellation calls.  If rt9455_hw_init() fails\nafter the IRQ has been requested, probe returns without cancelling work\nthat may already have been queued.  A pending callback can then access\nrt9455_info after it has been freed.\n\nRegister rt9455_cancel_all_delayed_works() through\ndevm_add_action_or_reset() right after devm_power_supply_register().\ndevres invokes the action in reverse registration order, after the\nmanaged IRQ has been freed and before rt9455_info is released, so the\ndelayed works are drained in both rt9455_remove() and the probe error\npath.  Cancel pwr_rdy_work and batt_presence_work before\nmax_charging_time_work because both can queue the latter.\n\nThis issue was found by an in-house static analysis tool.\n\n## Affected\n\n- `Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < 442c60c08ec23ac45da0a58877cab05e0a58f4ea`\n- `Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02`\n- `Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < 1b9978433c61a9b46e48832a1ebceee1cf5c9eb4`\n- `Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < 7323e562f6961e4b7bce3225cde4ecbc78260deb`\n- `Linux >= e86d69dd786e94046b8f5be7df1b9a8226a40b2a < 3e7a1ebc32fad5a558254a478efd401c17a24381`\n- `Linux 4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89465.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224756,"id":"CVE-2026-89465","ts":1792401522238,"field":"cvss","old":"5.5","new":"8.4"},{"seq":224755,"id":"CVE-2026-89465","ts":1792401522238,"field":"severity","old":"medium","new":"high"},{"seq":206992,"id":"CVE-2026-89465","ts":1789749735632,"field":"cvss","old":"8.4","new":"5.5"},{"seq":206991,"id":"CVE-2026-89465","ts":1789749735632,"field":"severity","old":"high","new":"medium"},{"seq":198049,"id":"CVE-2026-89465","ts":1789384321549,"field":"cvss","old":"7.5","new":"8.4"},{"seq":183534,"id":"CVE-2026-89465","ts":1789356675780,"field":"cvss","old":"8.4","new":"7.5"},{"seq":153240,"id":"CVE-2026-89465","ts":1789285349693,"field":"cvss","old":null,"new":"8.4"},{"seq":153239,"id":"CVE-2026-89465","ts":1789285349693,"field":"severity","old":"none","new":"high"},{"seq":147235,"id":"CVE-2026-89465","ts":1789270203301,"field":"cvss","old":null,"new":"7.5"},{"seq":147234,"id":"CVE-2026-89465","ts":1789270203301,"field":"severity","old":"none","new":"high"},{"seq":108988,"id":"CVE-2026-89465","ts":1789183729854,"field":"cvss","old":null,"new":"7.5"},{"seq":108987,"id":"CVE-2026-89465","ts":1789183729854,"field":"severity","old":"none","new":"high"}]}