Executive brief
A vulnerability was identified in the Linux kernel's ChromeOS hardware support that could cause a system crash. The issue occurs when the system attempts to use a Thunderbolt connection but fails to properly set up internal safety locks. This can lead to a 'NULL pointer dereference,' resulting in a kernel panic and immediate loss of system availability.
Technical details
A vulnerability exists in the 'cros_ec_typec' driver within the Linux kernel's platform/chrome directory. Specifically, the function 'cros_typec_register_thunderbolt()' fails to call 'mutex_init()' for the 'adata->lock' mutex. When the kernel later attempts to acquire this lock (for example, during 'cros_typec_altmode_work()'), it performs a NULL pointer dereference. This results in a kernel oops/panic. The issue is resolved by properly initializing the mutex during the Thunderbolt registration process. Patch information is available in the stable kernel trees.
Affected products
- Linux Linux Kernel versions including Thunderbolt support in cros_ec_typec
Timeline
- 2026-05-05: other: Patch authored
- 2026-05-28: disclosed: CVE published