EUVD-2026-80635
GHSA-fm22-hcrq-m39w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local driver-teardown path needs root (PR:H) and a narrow kthread-timing race (AC:H); impact is a UAF kernel crash (A:H) with slab corruption (I:L) and no disclosure (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
cc_debounce_dwork is queued from the set_cc() and start_toggling() callbacks, which run from TCPM's kthread worker. port_stop() returns before tcpm_unregister_port() destroys that worker. Flushing the worker during unregister may therefore run a callback which queues the delayed work after port_stop() has returned.
The delayed work can then run after devres has freed pmic_typec_port.
Use disable_delayed_work_sync() in port_stop() to cancel a pending instance and prevent the TCPM callbacks from queueing another one.
This issue was found by an in-house static analysis tool.
AnalysisAI
A race condition in the Linux kernel's Qualcomm PMIC USB Type-C driver (qcom-pmic-typec) can leave the cc_debounce_dwork delayed work queued after the port is torn down, resulting in a use-after-free once devres frees the pmic_typec_port structure. Systems running affected kernels from roughly 6.5 through the unfixed 6.12.110/6.18.51/7.2.5 baselines on Qualcomm PMIC Type-C hardware - typically Snapdragon-based phones and embedded boards - are exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires: (1) a system running an affected Linux kernel (~6.5 through pre-fix 6.12.110/6.18.51/7.2.5) with the qcom-pmic-typec driver bound - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a use-after-free / race condition (CWE-416/362) in the Qualcomm PMIC USB Type-C driver (qcom-pmic-typec), where the cc_debounce_dwork delayed work can be re-queued by a TCPM kthread callback during unregister and then execute after devres has freed the pmic_typec_port structure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a kernel containing the fix: Linux 6.12.110, 6.18.51, 7.2.5, or 7.3-rc2, or apply the upstream stable commits 4359b5f95c93a4658e08368fa6fab9d89eb98447, c614d7c44ca7fb78867ba46b233acdb59287e8c8, 1ab669c2b44e1040ddfab7cd7f717aad580d17aa, or 263f7d61a4201cde16849b2d016251806e7418be, which add a disable_delayed_work_sync() call in port_stop() to cancel cc_debounce_dwork and prevent the TCPM callbacks from re-queuing it (Vendor-released patch: 6.12.110, 6.18.51, 7.2.5, 7.3-rc2; fix details at https://nvd.nist.gov/vuln/detail/CVE-2026-90027 and the git.kernel.org stable links). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all devices running Linux kernels from roughly 6.5 through the unfixed 6.12.110, 6.18.51, and 7.2.5 baselines on Qualcomm PMIC Type-C hardware (e.g., Snapdragon-based phones and embedded boards) and consult the vendor advisory for the exact patched kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today