CVE-2025-21918

usb: typec: ucsi: Fix NULL pointer access

State: Published
Severity: 5.5 Medium
Published: Apr 1, 2025
Updated: May 11, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Fix NULL pointer access

Resources should be released only after all threads that utilize them have been destroyed. This commit ensures that resources are not released prematurely by waiting for the associated workqueue to complete before deallocating them.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	b9aa02ca39a49740926c2c450a1505a4a0f8954a to before 7a735a8a46f6ebf898bbefd96659ca5da798bce0Affected b9aa02ca39a49740926c2c450a1505a4a0f8954a to before 46fba7be161bb89068958138ea64ec33c0b446d4Affected b9aa02ca39a49740926c2c450a1505a4a0f8954a to before 079a3e52f3e751bb8f5937195bdf25c5d14fdff0Affected b9aa02ca39a49740926c2c450a1505a4a0f8954a to before 592a0327d026a122e97e8e8bb7c60cbbe7697344Affected b9aa02ca39a49740926c2c450a1505a4a0f8954a to before b13abcb7ddd8d38de769486db5bd917537b32ab1Affected
LinuxLinux	5.16Affected before 5.16Not affected 6.1.133 through 6.1.Not affected 6.6.83 through 6.6.Not affected 6.12.19 through 6.12.Not affected 6.13.7 through 6.13.Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

b9aa02ca39a49740926c2c450a1505a4a0f8954a to before 7a735a8a46f6ebf898bbefd96659ca5da798bce0Affected
b9aa02ca39a49740926c2c450a1505a4a0f8954a to before 46fba7be161bb89068958138ea64ec33c0b446d4Affected
b9aa02ca39a49740926c2c450a1505a4a0f8954a to before 079a3e52f3e751bb8f5937195bdf25c5d14fdff0Affected
b9aa02ca39a49740926c2c450a1505a4a0f8954a to before 592a0327d026a122e97e8e8bb7c60cbbe7697344Affected
b9aa02ca39a49740926c2c450a1505a4a0f8954a to before b13abcb7ddd8d38de769486db5bd917537b32ab1Affected

LinuxLinux

5.16Affected
before 5.16Not affected
6.1.133 through 6.1.*Not affected
6.6.83 through 6.6.*Not affected
6.12.19 through 6.12.*Not affected
6.13.7 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.