https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:12:54 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89474 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: bq256xx: drain usb_work before freeing the charger</p> <p>The USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq-&gt;charger). The reset devm action only unregisters the notifier and was registered before the power supplies, so devm frees bq-&gt;charger on unwind before the action runs; a usb_work still queued can then dereference it.</p> <p>Register the reset action after the power supplies, so it unregisters the notifiers and drains usb_work before the supplies are released. Initialize usb_work and obtain the PHY references before registering the notifiers, so the worker cannot run before the supplies exist.</p> <p>Found by static analysis.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: bq256xx: drain usb_work before freeing the charger</p> <p>The USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq-&gt;charger). The reset devm action only unregisters the notifier and was registered before the power supplies, so devm frees bq-&gt;charger on unwind before the action runs; a usb_work still queued can then dereference it.</p> <p>Register the reset action after the power supplies, so it unregisters the notifiers and drains usb_work before the supplies are released. Initialize usb_work and obtain the PHY references before registering the notifiers, so the worker cannot run before the supplies exist.</p> <p>Found by static analysis.</p> https://vulnerability.circl.lu/vuln/cve-2026-89474