Answer in brief
CVE-2026-89465 records a High severity (CVSS 8.4) vulnerability in power: supply: rt9455: quiesce delayed work before teardown. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e86d69dd786e94046b8f5be7df1b9a8226a40b2a <df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02 || >=e86d69dd786e94046b8f5be7df1b9a8226a40b2a <1b9978433c61a9b46e48832a1ebceee1cf5c9eb4 || >=e86d69dd786e94046b8f5be7df1b9a8226a40b2a <7323e562f6961e4b7bce3225cde4ecbc78260deb || >=e86d69dd786e94046b8f5be7df1b9a8226a40b2a <3e7a1ebc32fad5a558254a478efd401c17a24381 | df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02, 1b9978433c61a9b46e48832a1ebceee1cf5c9eb4, 7323e562f6961e4b7bce3225cde4ecbc78260deb, 3e7a1ebc32fad5a558254a478efd401c17a24381 |
| Linux/Linuxgeneric | 4.2 | Not reported |
| Linux/Linuxgeneric | >=e86d69dd786e94046b8f5be7df1b9a8226a40b2a <442c60c08ec23ac45da0a58877cab05e0a58f4ea || >=e86d69dd786e94046b8f5be7df1b9a8226a40b2a <df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02 || >=e86d69dd786e94046b8f5be7df1b9a8226a40b2a <1b9978433c61a9b46e48832a1ebceee1cf5c9eb4 || >=e86d69dd786e94046b8f5be7df1b9a8226a40b2a <7323e562f6961e4b7bce3225cde4ecbc78260deb || >=e86d69dd786e94046b8f5be7df1b9a8226a40b2a <3e7a1ebc32fad5a558254a478efd401c17a24381 | 442c60c08ec23ac45da0a58877cab05e0a58f4ea, df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02, 1b9978433c61a9b46e48832a1ebceee1cf5c9eb4, 7323e562f6961e4b7bce3225cde4ecbc78260deb, 3e7a1ebc32fad5a558254a478efd401c17a24381 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_work and batt_presence_work can also queue max_charging_time_work, while batt_presence_work can requeue itself. rt9455_remove() cancels max_charging_time_work before batt_presence_work. The latter can therefore queue max_charging_time_work after it has already been cancelled: rt9455_remove() workqueue cancel pwr_rdy_work cancel max_charging_time_work batt_presence_work queues max_charging_time_work cancel batt_presence_work return devres frees rt9455_info max_charging_time_work dereferences rt9455_info The IRQ also remains registered until devres cleanup and can queue more work after any of the cancellation calls. If rt9455_hw_init() fails after the IRQ has been requested, probe returns without cancelling work that may already have been queued. A pending callback can then access rt9455_info after it has been freed. Register rt9455_cancel_all_delayed_works() through devm_add_action_or_reset() right after devm_power_supply_register(). devres invokes the action in reverse registration order, after the managed IRQ has been freed and before rt9455_info is released, so the delayed works are drained in both rt9455_remove() and the probe error path. Cancel pwr_rdy_work and batt_presence_work before max_charging_time_work because both can queue the latter. This issue was found by an in-house static analysis tool.
Quoted source text, attributed separately from HOL analysis.