Linux Kernel EUVD-2026-39840

Three concurrent conditions must hold: (1) the target system has ps883x USB Type-C retimer hardware physically installed and the ps883x kernel driver loaded and bound to it - systems without this hardware are entirely unaffected; (2) the attacker or process has sufficient privilege to write to the kernel sysfs driver unbind interface, which in standard Linux configurations requires CAP_SYS_ADMIN (root); and (3) the driver must currently be bound (i.e., probe completed without returning an error). The crash is triggered exclusively by the unbind operation, not during normal I2C retimer operation. Limiting factors: hardware specificity sharply constrains the affected population; the CAP_SYS_ADMIN requirement prevents unprivileged triggering; and the crash requires an explicit, atypical administrative action rather than passive exploitation.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 (Medium) and correctly captures the local-only attack surface and pure availability impact. However, the PR:L rating warrants scrutiny: writing to the kernel sysfs driver unbind interface (/sys/bus/platform/devices/*/driver/unbind) typically requires CAP_SYS_ADMIN or root, suggesting PR:H is more accurate in standard configurations. EPSS at 0.17% (6th percentile) reflects very low exploitation likelihood, consistent with the narrow hardware prerequisite (ps883x retimer must be physically present and driver-bound). There is no CISA KEV listing and no reported public proof-of-concept. Real-world risk is low: exploitation is bounded by hardware specificity (select Lenovo and similar platforms), administrative access requirements, and the deliberate nature of the unbind operation. The primary concern is data-center or embedded environments where automated driver rebinding (e.g., for VFIO passthrough) could trigger the crash without explicit human action.

A system administrator or automated VFIO setup script executes 'echo bc0000.geniqup > /sys/bus/platform/devices/bc0000.geniqup/driver/unbind' on a system with a ps883x retimer, intending to pass the device through to a virtual machine. The kernel calls ps883x_retimer_remove(), which immediately dereferences NULL (the i2c client data never set during probe), generating an Oops at pc: ps883x_retimer_remove+0x14/0x94 and crashing the kernel. No public exploit code has been identified at time of analysis.