# CVE-2026-89464

## Summary

- **CVE ID:** CVE-2026-89464
- **Severity:** UNKNOWN
- **CVSS Score:** 0
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 16, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: twl4030_charger: cancel workers via devm

bci is devm-allocated. Two workers (bci->work and bci->current_worker)
dereference it. twl4030_bci_remove() disables charging and masks
interrupts. It cancels neither worker. A worker pending at remove() can
run after devm frees bci.

The USB transceiver comes from devm_usb_get_phy_by_node(). devm
unregisters its notifier only after remove() returns. A cancel_work_sync()
in remove() can then race a notifier reschedule. devm_work_autocancel()
and devm_delayed_work_autocancel() avoid that. They cancel the workers
during devm release, before bci is freed.

The current_worker is registered first, since devm will cancel in
reverse order and bci->work can reschedule current_worker.

[Move comment about order into the commit message]

## Affected Products

- Linux — Linux (d6ccc442b12102414c1343f0adacaa8a1aaa516c)
- Linux — Linux (2.6.39)
- Linux — Linux (0)
- Linux — Linux (6.12.109)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)
- Linux — Linux (5.15.221)
- Linux — Linux (6.1.188)
- Linux — Linux (6.6.157)

## References

- [CNA](https://git.kernel.org/stable/c/72a2d6cd049f892853e4e2d8d8fc5e7d0244a458)
- [CNA](https://git.kernel.org/stable/c/a4460e89d4088cfec2da5be33e265ef1a8e780e9)
- [CNA](https://git.kernel.org/stable/c/b955da82db4170bdf1c784dc457287aa0c977378)
- [CNA](https://git.kernel.org/stable/c/6eba34732524067da2aad5ddfdfbc641ded10e9e)
- [CNA](https://git.kernel.org/stable/c/9644c96ef8646c65d46caa5139a6631e29b79d6c)
- [CNA](https://git.kernel.org/stable/c/e9fffe10bd791082263c1678f2f6cdd6d7b487e0)
- [CNA](https://git.kernel.org/stable/c/c46c205bab0dfce4dd54aeb49da3f183e1fdfc63)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.17%
- **EPSS Percentile:** 7.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._