Executive brief
The Linux kernel's USB Type-C controller driver (hd3ss3220) for managing power delivery and charging contains a reference counting bug in VBUS (power bus) control. When multiple components try to enable power simultaneously, the driver can become unbalanced in its accounting of enable/disable operations, leading to kernel warnings and potential power delivery issues on affected USB Type-C devices.
Technical details
The vulnerability is a reference counting bug in the hd3ss3220 USB Type-C controller driver's VBUS regulator control logic. The root cause is that the driver relied on regulator_is_enabled() to determine whether to call regulator_enable() or regulator_disable(), but this function reports aggregate regulator state across all consumers rather than per-consumer state. When a second consumer enables VBUS first, the driver would skip its own enable call yet later attempt to disable it, creating an unbalanced reference count and triggering kernel warnings. The fix adds local tracking (vbus_enabled boolean) to maintain per-consumer state and ensures enable/disable calls remain balanced even if operations fail. The vulnerability is local in nature, requires no network access, and affects VBUS power delivery management during USB Type-C role/identity changes.
Affected products
- Linux Linux kernel before commit c9a48db776d7184981630ecc01a3ad30a8f7dc24
Timeline
- 2026-09-16: disclosed
- 2026-09-01: patched: Upstream patch committed