CVE-2026-89472

In the Linux kernel, the following vulnerability has been resolved:

power: supply: charger-manager: register regulators before exposing sysfs

charger_manager_remove() and the err_reg_extcon probe error path free each

charger regulator with regulator_put() before tearing down the power_supply

sysfs entries (power_supply_unregister()). charger_manager_remove() also

calls try_charger_enable(cm, false) after the regulator_put() loop. A

concurrent write to a charger's externally_control sysfs attribute that

lands between regulator_put() and power_supply_unregister() can run

charger_externally_control_store() and call try_charger_enable(), which,

when charging is enabled, dereferences the already-freed consumer handle.

When charging is enabled, try_charger_enable(cm, false) in .remove() also

dereferences the freed handles directly. Both leave use-after-free windows.

Symmetrically, probe registers the sysfs entries (power_supply_register)

before acquiring the regulators (regulator_get, inside

charger_manager_register_extcon), so userspace can reach externally_control

before the regulators are available.

Split charger_manager_register_extcon() on the sync/async boundary:

charger_manager_get_regulators() (regulator_get only, no async producer)

now runs before power_supply_register() so sysfs is not live before

regulators are available, and charger_manager_register_extcon() keeps only

the extcon notifier/work setup, still after power_supply_register() so a

power_supply_register() failure cannot reach extcon setup. This keeps the

sysfs setup/teardown ordering symmetric without introducing an asynchronous

producer on the earlier probe-error path.

Move power_supply_unregister() and try_charger_enable(cm, false) ahead of

the regulator_put() loop on both teardown paths, and adjust err_reg_extcon

(power_supply_unregister() then fall through err_regulator for

regulator_put(); get_regulators self-rolls back on its own failure).

This does not address the separate extcon-notifier-driven deref of the same

handles, which needs its own synchronization design.

Found by an in-house static analysis tool.