Use-after-free in Linux kernel - CVE-2026-89797

Vulnerability details

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in the ab8500 fuel-gauge driver workqueue teardown when a threaded interrupt handler fires during driver removal. A local user can cause a threaded interrupt handler to queue work on a freed workqueue to trigger a use-after-free condition.

Threaded interrupt handlers remain armed until driver removal returns.

Affected software

How to mitigate CVE-2026-89797

External References

• https://git.kernel.org/stable/c/013731074ab6a8d11ec209eee64c5b2656954479
• https://git.kernel.org/stable/c/75b1e88d34254f4fb7753345e21bfee47abddd7f
• https://git.kernel.org/stable/c/c660c017dec1fd7cd88e1103c5ae1aae6ce636bf

Related Security Bulletins

• Use-after-free in Linux kernel power supply driver