HIGH Introduced in 6.5
typec CcDebounce UAF
CVE-2026-90027
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop cc_debounce_dwork is queued from the set_cc() and start_toggling() callbacks, which run from TCPM's kthread worker. port_stop() returns before tcpm_unregister_port() destroys that worker. Flushing the worker during unregister may therefore run a callback which queues the delayed work after port_stop() has returned. The delayed work can then run after devres has freed pmic_typec_port. Use disable_delayed_work_sync() in port_stop() to cancel a pending instance and prevent the TCPM callbacks from queueing another one. This issue was found by an in-house static analysis tool.
02KernelScan AI Analysis
Risk summary
A race condition in the Qualcomm PMIC Type-C driver allows a delayed work item to execute after the port structure has been freed, resulting in a use-after-free. An attacker with local access to a device using this specific hardware could trigger the race during port teardown to crash the kernel or potentially corrupt memory. The vulnerability requires Qualcomm PMIC Type-C hardware to be present and a local actor capable of initiating driver or device removal.
Vulnerability analysis
A background task that manages connector state can be rescheduled by the port manager after the driver has already begun shutting down. Because the shutdown routine finishes before the port manager's background processing is fully stopped, a narrow window exists where a new task can be queued after cleanup has started. That task then runs after the driver has freed its internal data, causing a use-after-free. The fix cancels any pending task and blocks new ones from being queued during shutdown, ensuring no work runs after the data is freed. The flaw exists only in the Qualcomm PMIC Type-C driver and requires that specific hardware; a local user who can trigger driver teardown, such as by unbinding the driver or removing the device, can exploit the race.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.5 | 6.12.110 | 4359b5f95c93 |
| 7.2 | 6.5 | 7.2.5 | 1ab669c2b44e |
| mainline | 6.5 | 7.3-rc2 | 263f7d61a420 |
| 6.18 | 6.5 | 6.18.51 | c614d7c44ca7 |
| cip/6.12 | 6.5 | 6.12.111-cip32 | 4359b5f95c93 |