CVE-2026-89474

In the Linux kernel, the following vulnerability has been resolved:

power: supply: bq256xx: drain usb_work before freeing the charger

The USB-PHY notifier queues usb_work, whose handler calls

power_supply_changed(bq->charger). The reset devm action only unregisters

the notifier and was registered before the power supplies, so devm frees

bq->charger on unwind before the action runs; a usb_work still queued can

then dereference it.

Register the reset action after the power supplies, so it unregisters

the notifiers and drains usb_work before the supplies are released.

Initialize usb_work and obtain the PHY references before registering

the notifiers, so the worker cannot run before the supplies exist.

Found by static analysis.