Skip to main content

Linux Kernel EUVDEUVD-2026-48873

| CVE-2026-64329 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-x9xh-344g-4qc3
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition between remove path and in-flight IRQ handler requires winning a timing window, warranting AC:H over the vendor's AC:L; all other metrics retained.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.8 MEDIUM
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 14:54 vuln.today
CVSS changed
Sep 04, 2026 - 14:52 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:49 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(), which on a connector-change event calls ucsi_connector_change() and schedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees uc->ucsi (kfree) before free_irq() is called, so a handler invocation already in flight may access the freed object after ucsi_destroy().

CPU 0 (remove) | CPU 1 (threaded IRQ) ucsi_destroy(uc->ucsi) | ccg_irq_handler() kfree(ucsi) // FREE | ucsi_notify_common(uc->ucsi) // USE

Move free_irq() before ucsi_destroy() in the remove path. It is kept after ucsi_unregister(): ucsi_unregister() cancels connector work whose handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(), which waits for a completion that is signalled from the IRQ handler, so the IRQ must stay active until that work has been cancelled.

The probe error path already orders free_irq() before ucsi_destroy().

This bug was found by static analysis.

AnalysisAI

Use-after-free in the Linux kernel's USB Type-C UCSI CCG driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving arbitrary kernel code execution. The flaw exists in the module teardown path of the Cypress CCG UCSI driver: ucsi_ccg_remove() calls ucsi_destroy() - which kfree()s the ucsi object - before calling free_irq(), leaving a window in which the threaded IRQ handler ccg_irq_handler() can access the freed ucsi struct via ucsi_notify_common(). No public exploit code exists and the bug was discovered by static analysis; EPSS is 0.22% (13th percentile), reflecting no observed in-the-wild activity.

Technical ContextAI

The affected component is drivers/usb/typec/ucsi/ucsi_ccg.c in the Linux kernel, introduced at commit e32fd989ac1c (roughly Linux 5.5). The driver manages Cypress CCG USB Power Delivery controllers over I2C/HID, using a threaded IRQ (ccg_irq_handler) to process connector-change notifications. The root-cause class is CWE-416 Use-After-Free: the remove path invoked ucsi_destroy() - which kfrees the ucsi allocation - prior to free_irq(), violating the ordering invariant that no interrupt handler should be able to fire against freed memory. The correct fix moves free_irq() before ucsi_destroy() while keeping it after ucsi_unregister(), because ucsi_unregister() cancels pending connector work that itself waits on an IRQ-signalled completion. The CPE cpe:2.3:a:linux:linux is accurate but generic; the vulnerability is specific to systems with Cypress CCG USB Type-C controllers.

RemediationAI

Upgrade to a patched Linux kernel stable release: 5.10.261 or later on the 5.10 branch, 5.15.212 on 5.15, 6.1.178 on 6.1, 6.6.145 on 6.6, 6.12.96 on 6.12, 6.18.39 on 6.18, 7.1.4 on 7.1, or 7.2-rc3 on mainline. The fix commits are available at git.kernel.org/stable and referenced above. If kernel update is not immediately possible, a compensating control is to blacklist or unbind the ucsi_ccg kernel module (modprobe -r ucsi_ccg or echo in sysfs) on affected hardware; the trade-off is loss of USB Type-C power delivery negotiation. Systems without Cypress CCG USB-C controllers are not affected and require no action.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-48873 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy