PT-2026-64550 · Linux · Linux

CVE-2026-64329 · Published 2026-07-25 · Updated 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

The threaded IRQ handler ccg irq handler() calls ucsi notify common(), which on a connector-change event calls ucsi connector change() and schedules connector work. In ucsi ccg remove(), ucsi destroy() frees uc->ucsi (kfree) before free irq() is called, so a handler invocation already in flight may access the freed object after ucsi destroy().

CPU 0 (remove) | CPU 1 (threaded IRQ) ucsi destroy(uc->ucsi) | ccg irq handler() kfree(ucsi) // FREE | ucsi notify common(uc->ucsi) // USE

Move free irq() before ucsi destroy() in the remove path. It is kept after ucsi unregister(): ucsi unregister() cancels connector work whose handler issues GET CONNECTOR STATUS through ucsi send command common(), which waits for a completion that is signalled from the IRQ handler, so the IRQ must stay active until that work has been cancelled.

The probe error path already orders free irq() before ucsi destroy().

This bug was found by static analysis.

Related Identifiers

CVE-2026-64329

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64329 · Security Note
• https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d · Note
• https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5 · Note
• https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b · Note
• https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8 · Note
• https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426 · Note
• https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85 · Note
• https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9 · Note
• https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9 · Note