Executive brief
A vulnerability in the Linux kernel's USB Type-C driver for Parade PS883x retimers can cause the system to crash (kernel oops) when a device is disconnected or unbound from its driver. This issue primarily affects system stability and availability, potentially leading to a denial-of-service if a user or process triggers a driver unbind operation. It does not directly expose customer data but can disrupt operations on affected hardware.
Technical details
A NULL pointer dereference exists in the ps883x_retimer_remove() function within the drivers/usb/typec/mux/ps883x.c component of the Linux kernel. The root cause is a failure to initialize driver data using i2c_set_clientdata() during the device probe phase. When a local attacker or system process attempts to unbind the device (e.g., via sysfs), the removal routine attempts to retrieve this unset data via i2c_get_clientdata(), resulting in a NULL pointer dereference and a kernel 'Oops'. This vulnerability can be exploited by a local user with sufficient privileges to interact with sysfs to cause a denial-of-service. Patches have been released for various stable kernel branches including 6.18.x and 7.0.x.
Affected products
- Linux Linux Kernel 6.15 to 7.0.10
Timeline
- 2026-03-13: disclosed: Initial patch submitted by Google engineer
- 2026-05-23: patched: Patch committed to stable kernel trees
- 2026-06-26: advisory: CVE published in NVD dataset