---
id: CVE-2026-89475
title: 'power: supply: bq24257: fix use-after-free on remove'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  power: supply: bq24257: fix use-after-free on remove

  The STAT-pin interrupt is devm-managed, so it stays armed until the devm
  cleanup that runs after remove() returns.…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 <
    9d77fd7dd9a3ad57f7655c5264b503b85adbb7b8
  - >-
    Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 <
    a279e64c907f5638bb34cb8e2c9285798cf5f690
  - >-
    Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 <
    6d2eb93975c07b0169a3287efc1ae3b60cf52d8e
  - >-
    Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 <
    861ec73ce86e2ca18082cc7be4f140a5bbdf1428
  - >-
    Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 <
    f495808cdd6d9576965787cf6d9737d0b0e86b73
  - >-
    Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 <
    47ccbad210f48721c30d69d65b83dc9fff919ca9
  - >-
    Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 <
    9d34c9d660c3d0931d2cc749c46c47cf31f96e48
  - Linux 4.2
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:47:24.173Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89475'
references:
  - url: 'https://git.kernel.org/stable/c/9d77fd7dd9a3ad57f7655c5264b503b85adbb7b8'
  - url: 'https://git.kernel.org/stable/c/a279e64c907f5638bb34cb8e2c9285798cf5f690'
  - url: 'https://git.kernel.org/stable/c/6d2eb93975c07b0169a3287efc1ae3b60cf52d8e'
  - url: 'https://git.kernel.org/stable/c/861ec73ce86e2ca18082cc7be4f140a5bbdf1428'
  - url: 'https://git.kernel.org/stable/c/f495808cdd6d9576965787cf6d9737d0b0e86b73'
  - url: 'https://git.kernel.org/stable/c/47ccbad210f48721c30d69d65b83dc9fff919ca9'
  - url: 'https://git.kernel.org/stable/c/9d34c9d660c3d0931d2cc749c46c47cf31f96e48'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89475.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89475'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532090'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89475'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89475'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89475.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00211
epssPercentile: 0.11315
ingestedAt: '2026-09-14T15:23:07.453Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

power: supply: bq24257: fix use-after-free on remove

The STAT-pin interrupt is devm-managed, so it stays armed until the devm
cleanup that runs after remove() returns. remove() cancels
bq->iilimit_setup_work while the threaded handler can still fire; that
handler reschedules the work and dereferences bq, so the work runs
against freed memory once devm frees bq.

Make the delayed work device-managed with devm_delayed_work_autocancel(),
registered before the interrupt request. The devm cleanup then releases
the interrupt first, so the handler can no longer reschedule the work,
and cancels the work before bq is freed. The explicit
cancel_delayed_work_sync() in remove() is no longer needed and is dropped.

Found by static analysis.

## Affected

- `Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 < 9d77fd7dd9a3ad57f7655c5264b503b85adbb7b8`
- `Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 < a279e64c907f5638bb34cb8e2c9285798cf5f690`
- `Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 < 6d2eb93975c07b0169a3287efc1ae3b60cf52d8e`
- `Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 < 861ec73ce86e2ca18082cc7be4f140a5bbdf1428`
- `Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 < f495808cdd6d9576965787cf6d9737d0b0e86b73`
- `Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 < 47ccbad210f48721c30d69d65b83dc9fff919ca9`
- `Linux >= 2219a935963e5eeb19e5abfb99475fcc06bbb804 < 9d34c9d660c3d0931d2cc749c46c47cf31f96e48`
- `Linux 4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89475.json)