Riskcovery

CVE-2026-98758

usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

The pmic_glink client is released by the devres cleanup, which runs after pmic_glink_ucsi_remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi_unregister() has been called touches freed state: it dereferences the connector array that ucsi_unregister() freed, or registers and unregisters the instance a second time.

Disable both work items with disable_work_sync() before unregistering, and unregister only if the instance is still registered.

This issue was found by an in-house static analysis tool.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad to before 432b58cd959e594909a581b4974396cdbc9d4ca1Affected
  • 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad to before 41934f92e7a54d4080ac0b17aacc83224946785cAffected
  • 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad to before ee8577de01c6b6c7dd1d76b52242c54d37a989f4Affected
  • 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad to before 63b269ec537dc0fd26d0bd64872c26860d108c9dAffected
LinuxLinux
  • 6.4Affected
  • before 6.4Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.56 through 6.18.*Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.