Към съдържанието
Търсене

CVE-2026-89472: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs charger_manager_remove() and the err_reg_extcon probe error path free each charger regulator with regulator_put() before tearing down the power_supply sysfs entries (power_supply_unregister()). charger_manager_remove() also calls try_charger_enable(cm, false) after the regulator_put() loop. A concurrent write to a charger's externally_control sysfs attribute that lands between regulator_put() and power_supply_unregister() can run charger_externally_control_store() and call try_charger_enable(), which, when charging is enabled, dereferences the already-freed consumer handle. When charging is enabled, try_charger_enable(cm, false) in .remove() also dereferences the freed handles directly. Both leave use-after-free windows. Symmetrically, probe registers the sysfs entries (power_supply_register) before acquiring the regulators (regulator_get, inside charger_manager_register_extcon), so userspace can reach externally_control before the regulators are available. Split charger_manager_register_extcon() on the sync/async boundary: charger_manager_get_regulators() (regulator_get only, no async producer) now runs before power_supply_register() so sysfs is not live before regulators are available, and charger_manager_register_extcon() keeps only the extcon notifier/work setup, still after power_supply_register() so a power_supply_register() failure cannot reach extcon setup. This keeps the sysfs setup/teardown ordering symmetric without introducing an asynchronous producer on the earlier probe-error path. Move power_supply_unregister() and try_charger_enable(cm, false) ahead of the regulator_put() loop on both teardown paths, and adjust err_reg_extcon (power_supply_unregister() then fall through err_regulator for regulator_put(); get_regulators self-rolls back on its own failure). This does not address the separate extcon-notifier-

    Засегнати продукти

    • Linux Linux: 3950c7865cd7c963982a2c94457182b96732f4c9 преди 5763750916d28a29f1375a14dd6dadd5f2d2e178; 3950c7865cd7c963982a2c94457182b96732f4c9 преди 6e1645a6ee85d070c2d8dd847f1ce110dc2455c1; 3950c7865cd7c963982a2c94457182b96732f4c9 преди af3ce383ba0d0d48957a22ac7058ff5698775898; 3950c7865cd7c963982a2c94457182b96732f4c9 преди 86e4fa65368f3bbb506dddba8c9eedc75bd603b2; 3950c7865cd7c963982a2c94457182b96732f4c9 преди 6d532582ff3c420598f02945b13184c738cc1581; 3950c7865cd7c963982a2c94457182b96732f4c9 преди c57cb36f76eb7ced45f57af1a890d8f3a6d76342
    • Linux Linux: 3.7; преди 3.7; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.109 до 6.12.*; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

    История

    • 11 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-89472: Linux | freedomonline.bg