AZL-100617
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100617.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-100617
- Upstream
- Published
- 2026-09-11T20:19:27Z
- Modified
- 2026-09-13T06:06:36Z
- Summary
- CVE-2026-89464 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
power: supply: twl4030_charger: cancel workers via devm
bci is devm-allocated. Two workers (bci->work and bci->current_worker) dereference it. twl4030_bci_remove() disables charging and masks interrupts. It cancels neither worker. A worker pending at remove() can run after devm frees bci.
The USB transceiver comes from devm_usb_get_phy_by_node(). devm unregisters its notifier only after remove() returns. A cancel_work_sync() in remove() can then race a notifier reschedule. devm_work_autocancel() and devm_delayed_work_autocancel() avoid that. They cancel the workers during devm release, before bci is freed.
The current_worker is registered first, since devm will cancel in reverse order and bci->work can reschedule current_worker.
[Move comment about order into the commit message]
- References