CVE-2026-64329

usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

State: Published
Severity: Not scored
Published: Jul 25, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(), which on a connector-change event calls ucsi_connector_change() and schedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees uc->ucsi (kfree) before free_irq() is called, so a handler invocation already in flight may access the freed object after ucsi_destroy().

CPU 0 (remove) | CPU 1 (threaded IRQ) ucsi_destroy(uc->ucsi) | ccg_irq_handler() kfree(ucsi) // FREE | ucsi_notify_common(uc->ucsi) // USE

Move free_irq() before ucsi_destroy() in the remove path. It is kept after ucsi_unregister(): ucsi_unregister() cancels connector work whose handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(), which waits for a completion that is signalled from the IRQ handler, so the IRQ must stay active until that work has been cancelled.

The probe error path already orders free_irq() before ucsi_destroy().

This bug was found by static analysis.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before f1adeb1ff8bef1467d6961059810795d02bbad5dAffected e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before 99381e762273a2410a3f0216000be32b013c0ea9Affected e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before 1a160076d3d0dcd4a98a4599ad96eec0790b099bAffected e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before c32df11147822d22facee8fa30c2e8971d12f426Affected e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before 86c9ee928c4a370e323e432aaf8dca79c4ba7c85Affected e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before f5c772b76bbd95de8be51cf849c6098f6af6fcf9Affected e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before dbb500bad02146b388041877574829016591ddc8Affected e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before 1f0bdc2884b67de337215079bba166df0cdf4ac5Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before f1adeb1ff8bef1467d6961059810795d02bbad5dAffected
e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before 99381e762273a2410a3f0216000be32b013c0ea9Affected
e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before 1a160076d3d0dcd4a98a4599ad96eec0790b099bAffected
e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before c32df11147822d22facee8fa30c2e8971d12f426Affected
e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before 86c9ee928c4a370e323e432aaf8dca79c4ba7c85Affected
e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before f5c772b76bbd95de8be51cf849c6098f6af6fcf9Affected
e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before dbb500bad02146b388041877574829016591ddc8Affected
e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 to before 1f0bdc2884b67de337215079bba166df0cdf4ac5Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.