EUVD-2026-87059
GHSA-7h52-f32w-m42c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal low-privilege access on affected host
-
ExploitTrigger repeated UCSI unregister/register via remoteproc restart
-
ImpactLeak debugfs entries and fail re-registration
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup on lifecycle end
|
| Exploitation Conditions | Exploitation requires local access to a system running the kernel USB Type-C UCSI subsystem with a driver that unregisters and re-registers the same UCSI instance across remoteproc restart - specifically ucsi_glink/pmic_glink on Qualcomm platforms (the log string 'pmic_glink.ucsi.0 already exists in ucsi' is the signature). It is NOT remotely reachable and NOT triggerable against generic default configurations lacking that driver/hardware. Limiting factors: low-privilege local access is needed (PR:L), the specific ucsi_glink driver and remoteproc restart cycling must occur, and impact accrues only across repeated register/unregister cycles rather than from a single action. |
| Impact | This is a genuinely low-priority issue despite the CWE and tags, and multiple signals agree. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) establishes a local, low-privilege, availability-only flaw with no confidentiality or integrity impact - yet it rates A:H, which appears overstated for what the description actually shows (a leaked set of debugfs directories and a failed re-registration producing a log warning, not an immediate system crash). EPSS is 0.16% (4th percentile), consistent with a kernel housekeeping fix rather than an attacker-attractive bug. It is NOT in CISA KEV and no POC is referenced, so there is no evidence of exploitation. No SSVC decision data was provided. The 'Information Disclosure' tag conflicts with both the CWE (CWE-772, missing release of resource) and the vector (C:N) - this is a resource leak, not disclosure, so the tag should be treated as unreliable. Net: a real correctness/resource-management bug worth patching in affected stable trees, but low real-world security risk and not a priority over internet-facing or network-reachable issues. |
| Exploit ScenarioDerived | A local, low-privilege actor on a system using the ucsi_glink/pmic_glink USB Type-C stack repeatedly drives the UCSI instance through unregister/register cycles (e.g., via remoteproc firmware restarts). Each cycle fails to tear down the prior debugfs entries, leaking per-instance debugfs directories and triggering 'already exists' re-registration failures. No public exploit is identified at time of analysis, and the practical effect is gradual resource leakage and driver re-init failure rather than remote compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Leaked debugfs entries in the Linux kernel's USB Type-C UCSI subsystem cause repeated registration of the same UCSI instance to fail, producing the signature error "debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'" across register/unregister cycles. The bug is reachable only locally by a low-privileged user on systems that exercise the ucsi_glink driver (Qualcomm pmic_glink/remoteproc platforms that tear down and re-create the UCSI instance), and it requires repeated cycles rather than a single action, so our assessed vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - a low-priority robustness/availability defect, not a remotely exploitable one. There is no public exploit code and no confirmed active exploitation (EPSS 0.16%, 4th percentile); vendor patches are available in Linux 6.6.157, 6.12.110, 6.18.52, 7.2.6 and mainline 7.3-rc1.
RemediationAI
Apply the vendor-released patch by upgrading to Linux 6.6.157, 6.12.110, 6.18.52 or 7.2.6 (mainline 7.3-rc1), which unregister the per-instance debugfs entries during ucsi_unregister() and clear ucsi->debugfs after freeing so repeated unregister paths stay safe; the corresponding stable commits are https://git.kernel.org/stable/c/fb7393519908befdc094be4ea913f582adbf2f7c, https://git.kernel.org/stable/c/7177c215e69658adbd2f2fc5b72e14be9208d2ba, https://git.kernel.org/stable/c/1f44d001620fd3caa30619a9bc73e9d15555408b, https://git.kernel.org/stable/c/62efee351566321ad72a4abaf6eb7d972590585d and https://git.kernel.org/stable/c/eed73a65ab609b79d53de88cccc34b36dfe753c4, with the CVE detail at https://nvd.nist.gov/vuln/detail/CVE-2026-100079. If immediate kernel upgrade is not feasible, the practical compensating controls are to restrict unprivileged local access (the vector requires PR:L, so limiting shell access to untrusted users removes the trigger) and to avoid or throttle the pmic_glink/remoteproc restarts that force the ucsi_glink instance through repeated unregister/register cycles - this suppresses both the 'already exists in ucsi' error spam and the accumulation of leaked dentries, but it is only a stopgap because the underlying missing resource release remains, and its side effect is that deliberate remoteproc recovery/restart of the DSP/ADSP is delayed or suppressed, which can affect modem/audio/Type-C behavior on Qualcomm platforms. Because debugfs is root-only by default and this is a resource-leak issue rather than a memory-corruption or remote-input flaw, hardening debugfs mounts adds little beyond the default; no network-level mitigations are applicable since exploitation is strictly local and no public exploit code exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is the generic UCSI (USB Type-C Connector System Software Interface) core in the Linux kernel, tracked by CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. ucsi_register() allocates a per-instance debugfs directory under 'ucsi' (e.g. 'pmic_glink.ucsi.0'), but ucsi_unregister() historically left those entries in place and only ucsi_destroy() released them - a textbook CWE-772 (Missing Release of Resource after Effective Lifetime) defect. The failure only manifests when a driver unregisters and re-registers the same UCSI instance; the primary trigger is ucsi_glink, used with Qualcomm's pmic_glink/remoteproc stack, where a remoteproc restart cycles the instance and the subsequent debugfs_create_dir() call finds the old directory still present and logs the 'already exists in ucsi' error. Each individual failure is non-fatal, but stale dentries and repeated failed registrations accumulate over cycles, degrading the UCSI/Type-C connector stack's ability to manage the port (assessed impact C:N/I:N/A:L; NVD scored this 5.5 with A:H, which our assessment considers overstated for the supported trigger path). The upstream fix unregisters the debugfs entries inside ucsi_unregister() and NULLs ucsi->debugfs after freeing, making repeated unregister paths safe. Because debugfs is mounted with root-only access by default and the trigger requires a specific local driver/hardware combination, the exposure surface is narrow; the vector's PR:L confirms local low-privilege authentication is needed and no remote or network path exists.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local, low-privilege-triggered debugfs resource leak with no data impact; availability effect is gradual and limited, so A:L rather than the input's A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: unregister debugfs entries on teardown
ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them around until ucsi_destroy().
Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory and log:
debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsi_unregister(), and clear ucsi->debugfs after freeing it so repeated unregister paths remain safe.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB