CVE-2026-89472power: supply: charger-manager: register regulators before exposing sysfs

Official description

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs charger_manager_remove() and the err_reg_extcon probe error path free each charger regulator with regulator_put() before tearing down the power_supply sysfs entries (power_supply_unregister()). charger_manager_remove() also calls try_charger_enable(cm, false) after the regulator_put() loop. A concurrent write to a charger's externally_control sysfs attribute that lands between regulator_put() and power_supply_unregister() can run charger_externally_control_store() and call try_charger_enable(), which, when charging is enabled, dereferences the already-freed consumer handle. When charging is enabled, try_charger_enable(cm, false) in .remove() also dereferences the freed handles directly. Both leave use-after-free windows. Symmetrically, probe registers the sysfs entries (power_supply_register) before acquiring the regulators (regulator_get, inside charger_manager_register_extcon), so userspace can reach externally_control before the regulators are available. Split charger_manager_register_extcon() on the sync/async boundary: charger_manager_get_regulators() (regulator_get only, no async producer) now runs before power_supply_register() so sysfs is not live before regulators are available, and charger_manager_register_extcon() keeps only the extcon notifier/work setup, still after power_supply_register() so a power_supply_register() failure cannot reach extcon setup. This keeps the sysfs setup/teardown ordering symmetric without introducing an asynchronous producer on the earlier probe-error path. Move power_supply_unregister() and try_charger_enable(cm, false) ahead of the regulator_put() loop on both teardown paths, and adjust err_reg_extcon (power_supply_unregister() then fall through err_regulator for regulator_put(); get_regulators self-rolls back on its own failure). This does not address the separate extcon-notifier-driven deref of the same handles, which needs its own synchronization design. Found by an in-house static analysis tool.

Affected packages & fixed versions

Affected products (as reported)

References

• https://git.kernel.org/stable/c/5763750916d28a29f1375a14dd6dadd5f2d2e178
• https://git.kernel.org/stable/c/6e1645a6ee85d070c2d8dd847f1ce110dc2455c1
• https://git.kernel.org/stable/c/af3ce383ba0d0d48957a22ac7058ff5698775898
• https://git.kernel.org/stable/c/86e4fa65368f3bbb506dddba8c9eedc75bd603b2
• https://git.kernel.org/stable/c/6d532582ff3c420598f02945b13184c738cc1581
• https://git.kernel.org/stable/c/c57cb36f76eb7ced45f57af1a890d8f3a6d76342