---
id: CVE-2026-89464
title: 'power: supply: twl4030_charger: cancel workers via devm'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  power: supply: twl4030_charger: cancel workers via devm

  bci is devm-allocated. Two workers (bci->work and bci->current_worker)
  dereference it. twl4030_bci_remove() dis…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c <
    9644c96ef8646c65d46caa5139a6631e29b79d6c
  - >-
    Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c <
    e9fffe10bd791082263c1678f2f6cdd6d7b487e0
  - >-
    Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c <
    c46c205bab0dfce4dd54aeb49da3f183e1fdfc63
  - >-
    Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c <
    72a2d6cd049f892853e4e2d8d8fc5e7d0244a458
  - >-
    Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c <
    a4460e89d4088cfec2da5be33e265ef1a8e780e9
  - >-
    Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c <
    b955da82db4170bdf1c784dc457287aa0c977378
  - >-
    Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c <
    6eba34732524067da2aad5ddfdfbc641ded10e9e
  - Linux 2.6.39
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:47:13.492Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89464'
references:
  - url: 'https://git.kernel.org/stable/c/9644c96ef8646c65d46caa5139a6631e29b79d6c'
  - url: 'https://git.kernel.org/stable/c/e9fffe10bd791082263c1678f2f6cdd6d7b487e0'
  - url: 'https://git.kernel.org/stable/c/c46c205bab0dfce4dd54aeb49da3f183e1fdfc63'
  - url: 'https://git.kernel.org/stable/c/72a2d6cd049f892853e4e2d8d8fc5e7d0244a458'
  - url: 'https://git.kernel.org/stable/c/a4460e89d4088cfec2da5be33e265ef1a8e780e9'
  - url: 'https://git.kernel.org/stable/c/b955da82db4170bdf1c784dc457287aa0c977378'
  - url: 'https://git.kernel.org/stable/c/6eba34732524067da2aad5ddfdfbc641ded10e9e'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89464.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89464'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532107'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89464'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89464'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89464.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00173
epssPercentile: 0.06642
ingestedAt: '2026-09-14T15:23:07.453Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

power: supply: twl4030_charger: cancel workers via devm

bci is devm-allocated. Two workers (bci->work and bci->current_worker)
dereference it. twl4030_bci_remove() disables charging and masks
interrupts. It cancels neither worker. A worker pending at remove() can
run after devm frees bci.

The USB transceiver comes from devm_usb_get_phy_by_node(). devm
unregisters its notifier only after remove() returns. A cancel_work_sync()
in remove() can then race a notifier reschedule. devm_work_autocancel()
and devm_delayed_work_autocancel() avoid that. They cancel the workers
during devm release, before bci is freed.

The current_worker is registered first, since devm will cancel in
reverse order and bci->work can reschedule current_worker.

[Move comment about order into the commit message]

## Affected

- `Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c < 9644c96ef8646c65d46caa5139a6631e29b79d6c`
- `Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c < e9fffe10bd791082263c1678f2f6cdd6d7b487e0`
- `Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c < c46c205bab0dfce4dd54aeb49da3f183e1fdfc63`
- `Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c < 72a2d6cd049f892853e4e2d8d8fc5e7d0244a458`
- `Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c < a4460e89d4088cfec2da5be33e265ef1a8e780e9`
- `Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c < b955da82db4170bdf1c784dc457287aa0c977378`
- `Linux >= d6ccc442b12102414c1343f0adacaa8a1aaa516c < 6eba34732524067da2aad5ddfdfbc641ded10e9e`
- `Linux 2.6.39`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89464.json)