Executive brief
A vulnerability was identified in the Linux kernel's USB Type-C driver where the system could crash when handling certain USB device connections. This occurs because the software fails to stop processing after a failed device registration, leading to an invalid memory access. While primarily a stability issue, it could lead to a system crash (denial of service) when specific USB hardware is interacted with.
Technical details
An error pointer dereference vulnerability exists in the Linux kernel in drivers/usb/typec/tipd/core.c within the cd321x_update_work() function. The code checks if typec_register_partner() returns an error pointer (ERR_PTR) and issues a warning, but fails to exit the function. Consequently, the invalid pointer is subsequently passed to typec_partner_set_identity(), resulting in a kernel oops or crash. This issue affects the TI PD (TPS6598x) driver specifically when handling CD321x mode transitions. Patches have been merged into the stable kernel branches to include an early return upon registration failure.
Affected products
- Linux Linux Kernel 6.18, 7.0, 7.1
Timeline
- 2026-02-18: other: Patch submitted by developer
- 2026-06-24: disclosed: CVE published