CVE-2026-89469

What it actually does

Use-after-free in the Linux kernel LP8727 charger (power-supply) driver: during driver teardown, lp8727_release_irq() cancels delayed work before freeing the IRQ, so a threaded IRQ handler can re-arm pchg->work. After .remove returns, devm frees the private pchg object while lp8727_delayed_func() may still run and dereference it, corrupting kernel memory (arbitrary read/write, privilege escalation, or panic) in kernel context.

Why it matters to the business

On devices that actually bind the LP8727 charger driver (typically embedded, mobile, or SoC platforms), this can cause kernel crashes, unexpected reboots, or full host compromise from local code. It is not listed in CISA KEV, has no known in-the-wild exploitation, and EPSS remains very low and flat (~0.14% over 30 days), so mass-opportunistic risk is limited; impact is concentrated on fleets that ship this driver and allow local unprivileged access or frequent driver unbind/unload.

How an attack unfolds

A local attacker targets a system with the lp8727 driver bound. They induce a race around driver removal (module unload, device unbind, or equivalent teardown) so an interrupt arrives after delayed work is cancelled but before the IRQ is freed. The still-registered threaded handler (lp8727_isr_func) re-queues delayed work. Once .remove completes, the managed device data is freed; the delayed worker then touches freed kernel memory. Abuse of that dangling pointer can overwrite kernel objects for local privilege escalation or force a denial of service. No named threat actors, KEV use, or public exploit maturity are associated with this issue.

How to fix it

Apply the upstream Linux kernel fix for the LP8727 driver that frees the IRQ first (quiescing the threaded handler so it cannot queue further work) and only then cancels/drains the delayed work. Upgrade to a distribution or vendor kernel that includes this change. If a patched kernel is not yet available, mitigate by not unloading/unbinding the lp8727 driver at runtime, restricting local unprivileged access and device-unbind capabilities (for example sysfs unbind and module unload), and limiting who can load/unload power-supply modules. No package-specific fixed versions were supplied with this record; track your kernel vendor’s stable tree for the lp8727_release_irq ordering fix.

How to confirm the fix worked

Confirm the running kernel includes the lp8727_release_irq change (free_irq before cancel of delayed work), via vendor changelog, git history, or inspection of the driver source in the installed kernel tree. Check whether the driver is present or bound (lsmod, sysfs power_supply / i2c client for lp8727) to determine exposure. After patching, rebuild/reboot onto the new kernel and verify the module or built-in driver matches the patched version; regression-test charger probe/remove and IRQ storm/unbind paths in a lab if you ship this hardware.

Typical attack path

1. Obtain local execution on a Linux system where the LP8727 charger driver is loaded and can be torn down
2. Trigger driver removal or unbind while charger IRQs can still fire
3. Win the teardown race so the threaded IRQ handler re-arms delayed work after cancel but before free_irq
4. Allow .remove/devm to free pchg while lp8727_delayed_func still runs
5. Corrupt kernel memory via the use-after-free to crash the host or escalate to kernel privileges

How to detect it

This is a local teardown race with no network signature and no public exploit tooling, so look for post-exploitation kernel crashes rather than a distinct C2 pattern. Review dmesg, journald kernel logs, kdump/vmcore, and panic logs around lp8727 driver remove/unbind for use-after-free, paging requests, or workqueue execution after free. KASAN/KFENCE/debug kernels may explicitly report UAF in lp8727_delayed_func. Correlate oops timestamps with module unload, sysfs unbind, or device removal of the LP8727 client. Absence of these artifacts does not prove non-exploitation; successful quiet UAF abuse may leave only later privilege-escalation indicators.

• lp8727_delayed_func
• lp8727_release_irq
• lp8727_isr_func
• lp8727:
• Workqueue: events lp8727
• BUG: KASAN: use-after-free in lp8727
• Unable to handle kernel paging request
• Oops:.*lp8727
• modprobe -r lp8727
• echo .* > .*/lp8727.*/unbind
• Call Trace:.*lp8727_delayed_func

What your security team should do

• Inventory Linux endpoints and embedded images for the lp8727 charger driver (built-in or module) and treat those images as in-scope
• Prioritize kernel updates that contain the lp8727_release_irq IRQ-then-cancel-work fix; this is High CVSS but not KEV and EPSS is low—patch on the normal kernel cadence unless you run this hardware with untrusted local users
• Until patched, prevent runtime unbind/unload of lp8727 and restrict local access and CAP_SYS_MODULE / sysfs driver unbind
• Enable kernel hardening that reduces UAF reliability where possible (KASLR, CFI, slab hardening) and collect vmcore/kdump on oops for later triage
• Reassess if public exploits or KEV listing appear; current exploit maturity is None and EPSS is stable