https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:41:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89469 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: lp8727: fix use-after-free in lp8727_release_irq()</p> <p>lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg-&gt;work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it.</p> <p>Free the IRQ first so the threaded handler is quiesced and can no longer queue work, then cancel the delayed work to drain the final generation.</p> <p>This issue was found by an in-house static analysis tool.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: lp8727: fix use-after-free in lp8727_release_irq()</p> <p>lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg-&gt;work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it.</p> <p>Free the IRQ first so the threaded handler is quiesced and can no longer queue work, then cancel the delayed work to drain the final generation.</p> <p>This issue was found by an in-house static analysis tool.</p> https://vulnerability.circl.lu/vuln/cve-2026-89469