CVE-2026-90395

What it actually does

Use-after-free in isp1704_charger driver: USB notifier and VBUS work can still execute after power supply teardown because work is not canceled on remove.

Why it matters to the business

Kernel crashes or memory corruption possible on systems with this charger hardware during unplug or driver unload, though low exploit maturity limits widespread operational disruption.

How an attack unfolds

Local attacker triggers repeated USB insertion/removal or module unload to queue work, then forces removal path to free structures while the work item is still pending or running.

How to fix it

Patch the kernel to unregister the notifier, cancel the work item with cancel_work_sync, then unregister the power supply; apply any upstream fix for isp1704_charger remove path.

How to confirm the fix worked

Inspect isp1704_charger.c remove function for presence of cancel_work_sync after notifier unregistration and before power_supply_unregister; verify no work references remain after teardown.

Typical attack path

1. Obtain local access on affected Linux system
2. Trigger USB VBUS events or charger module load/unload sequences
3. Race the remove path against pending work execution
4. Trigger use-after-free for denial of service or potential privilege escalation

How to detect it

Search kernel logs and dmesg for isp1704, workqueue, or power_supply oops/panics occurring around USB or charger removal events; correlate with module unload timestamps.

What your security team should do

• Prioritize kernel updates on systems exposing isp1704_charger hardware
• Review logs for workqueue or power-supply related oops during device events
• Disable or avoid the driver if hardware is not required until patched