Bug 2532246 (CVE-2026-89473) - CVE-2026-89473 kernel: Linux Kernel: Denial of service via bq25890 driver reference leak.
Summary: CVE-2026-89473 kernel: Linux Kernel: Denial of service via bq25890 driver ref...
Keywords:
Status: NEW
Alias: CVE-2026-89473
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-11 21:40 UTC by OSIDB Bzimport
Modified: 2026-09-11 22:01 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-11 21:40:42 UTC
In the Linux kernel, the following vulnerability has been resolved:

power: supply: bq25890: Fix power_supply reference leak

bq25890_fw_probe() acquires a reference to a secondary charger using
power_supply_get_by_name(), but the reference is not released on later
probe failures or on driver detach.

In particular, failures after bq25890_fw_probe() returns successfully,
such as a failure in bq25890_hw_init(), also leak the reference.

Register a device-managed cleanup action immediately after acquiring
the secondary charger. This releases the reference on all subsequent
probe failures and on driver detach.

Found by code review.


Note You need to log in before you can comment on or make changes to this bug.