Executive brief
A flaw in the Linux kernel's Qualcomm PMIC Type-C driver can cause a use-after-free condition when the USB port is stopped. A delayed work queue may execute after the driver has freed its memory, potentially leading to kernel crashes or unexpected system behavior in devices using Qualcomm PMIC power management chips for USB Type-C port control.
Technical details
The vulnerability is a use-after-free condition in the Qualcomm PMIC Type-C driver (qcom_pmic_typec_port.c). The cc_debounce_dwork delayed work is queued by set_cc() and start_toggling() callbacks running from TCPM's kthread worker. When port_stop() returns before tcpm_unregister_port() destroys the worker thread, callbacks can queue the delayed work after port_stop() has returned. This allows the delayed work to execute after devres has freed the pmic_typec_port structure. The fix adds disable_delayed_work_sync() in port_stop() to cancel any pending delayed work and prevent TCPM callbacks from queueing new instances. This issue affects Linux kernel v6.10 and later; the patch is available in the stable tree.
Affected products
- Linux Linux kernel v6.10 and later
Timeline
- 2026-09-16: disclosed: CVE-2026-90027 published
- 2026-09-01: patched: Upstream fix committed (263f7d61a4201cde16849b2d016251806e7418be)
- 2026-09-11: patched: Backport to stable tree (1ab669c2b44e1040ddfab7cd7f717aad580d17aa)