HIGH Introduced in 6.15
phy TypeCSwitch Leak
CVE-2026-93225
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI2.3LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95_usb_phy_get_tca() succeeds, the typec switch leaks because the only cleanup path was in .remove(), which never runs on probe failure. Use devm_add_action_or_reset() so the switch is cleaned up on both probe failure and driver removal. The imx95_usb_phy_put_tca() is no longer needed, it will be removed in .remove() too.
02KernelScan AI Analysis
Risk summary
A memory leak in the NXP i.MX95 USB PHY driver allows a typec switch object to leak when a device probe fails. This can be triggered by an administrator or via hardware state manipulation, leading to minor resource consumption. The impact is limited to a low-severity availability concern with no risk of data corruption or privilege escalation.
Vulnerability analysis
A memory leak occurs in the NXP i.MX95 USB PHY driver when device probing fails after successfully registering a Type-C switch. The original code only cleaned up the switch during driver removal, a path that is never reached if the initial probe fails midway, causing the switch object to leak. The fix uses a device-managed cleanup action so the switch is automatically unregistered on both probe failure and normal driver removal. This vulnerability is reachable locally on systems with the i.MX95 USB PHY hardware, typically requiring administrative privileges or physical access to trigger the probe error path.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.15 | 6.18.50 | f1b7b2c7ffa9 |
| 7.2 | 6.15 | 7.2.4 | 84646f5b945a |
| mainline | 6.15 | 7.3 | 87a1805b1c34 |