CVE-2026-89469

A use-after-free exists in the Linux kernel's LP8727 power-supply (charger) driver: lp8727_release_irq() cancels a delayed work item before freeing the IRQ, so an interrupt arriving in that window can re-arm the work via the threaded IRQ handler; after the remove path returns, the devm layer frees the pchg structure while lp8727_delayed_func() may still run and dereference it. The bug is triggered by a race between interrupt delivery and driver unbind/removal (for example device hot-unplug or a manual driver unbind), which a local unprivileged attacker may be able to provoke. Successful exploitation of the stale pointer can corrupt freed kernel memory, plausibly causing a system crash (denial of service) or local privilege escalation, consistent with the CVSS 3.1 score of 8.4 (high, local vector, no privileges or user interaction required). Affected systems are those running kernels that build in the lp8727 driver, typically embedded or ARM boards using the Texas Instruments LP8727 charger IC. No public proof of concept is known, the flaw is not in CISA's KEV, and no in-the-wild exploitation has been reported.

What to do: Apply kernel updates from your distribution or vendor once the fix (freeing the IRQ before canceling the delayed work in lp8727_release_irq()) reaches stable releases. If the LP8727 charger driver is not needed, disable it in the kernel configuration or blacklist the module to eliminate the attack surface. On affected embedded devices, restrict local unprivileged access and the ability to unbind drivers via sysfs, and watch kernel logs for oopses in lp8727_delayed_func/lp8727_release_irq as a sign of the race being hit.