GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-90027 (GCVE-0-2026-90027)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
Title
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop cc_debounce_dwork is queued from the set_cc() and start_toggling() callbacks, which run from TCPM's kthread worker. port_stop() returns before tcpm_unregister_port() destroys that worker. Flushing the worker during unregister may therefore run a callback which queues the delayed work after port_stop() has returned. The delayed work can then run after devres has freed pmic_typec_port. Use disable_delayed_work_sync() in port_stop() to cancel a pending instance and prevent the TCPM callbacks from queueing another one. This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < 4359b5f95c93a4658e08368fa6fab9d89eb98447 (git)
Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < c614d7c44ca7fb78867ba46b233acdb59287e8c8 (git)
Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < 1ab669c2b44e1040ddfab7cd7f717aad580d17aa (git)
Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < 263f7d61a4201cde16849b2d016251806e7418be (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4359b5f95c93a4658e08368fa6fab9d89eb98447",
              "status": "affected",
              "version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
              "versionType": "git"
            },
            {
              "lessThan": "c614d7c44ca7fb78867ba46b233acdb59287e8c8",
              "status": "affected",
              "version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
              "versionType": "git"
            },
            {
              "lessThan": "1ab669c2b44e1040ddfab7cd7f717aad580d17aa",
              "status": "affected",
              "version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
              "versionType": "git"
            },
            {
              "lessThan": "263f7d61a4201cde16849b2d016251806e7418be",
              "status": "affected",
              "version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop\n\ncc_debounce_dwork is queued from the set_cc() and start_toggling()\ncallbacks, which run from TCPM\u0027s kthread worker.  port_stop() returns\nbefore tcpm_unregister_port() destroys that worker.  Flushing the worker\nduring unregister may therefore run a callback which queues the delayed\nwork after port_stop() has returned.\n\nThe delayed work can then run after devres has freed pmic_typec_port.\n\nUse disable_delayed_work_sync() in port_stop() to cancel a pending\ninstance and prevent the TCPM callbacks from queueing another one.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The use-after-free is reached on Qualcomm PMIC Type-C platform-driver teardown (sysfs unbind, rmmod, or probe-error unwind after TCPM is registered), not by parsing USB-C/PD traffic from a plugged partner. That matches other USB gadget/UDC and onboard Type-C teardown UAFs scored Local and is higher severity than Physical.\nAC:L - An attacker who initiates remove controls both sides: TCPM set_cc/start_toggling queue the 2ms cc_debounce_dwork, and kthread_destroy_worker() in tcpm_unregister_port() can run those callbacks after port_stop() returns, re-queueing work that then runs after devres frees pmic_typec_port. Use-after-free bugs are AC:L unless the attacker cannot influence the race.\nPR:L - Highest reasonable exposure is a local account on Qualcomm phones, automotive, and embedded boards that manage the Type-C/USB stack, where platform unbind or USB HAL access is often delegated beyond init-namespace root. Uncertain Low versus High, so Low per the overestimate rule.\nUI:N - The attacker initiates driver unbind, module unload, or a failing re-probe themselves; no separate victim action such as plugging a USB-C cable, mounting a filesystem, or opening a device node is required.\nS:U - The use-after-free corrupts the host kernel pmic_typec_port heap object within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - qcom_pmic_typec_port_cc_debounce() recovers the freed pmic_typec_port via container_of and reads its spinlock and device pointer; per CNA guidance a use-after-free enables arbitrary kernel memory disclosure.\nI:H - The same delayed work writes debouncing_cc and performs spin_lock/unlock on the freed object, and the pending delayed_work lives inside pmic_typec_port, so heap spray yields an arbitrary write or workqueue function-pointer hijack.\nA:H - Use-after-free of pmic_typec_port from system-wq delayed work after remove causes a kernel oops or panic even without a full exploit, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:41:43.363Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4359b5f95c93a4658e08368fa6fab9d89eb98447"
        },
        {
          "url": "https://git.kernel.org/stable/c/c614d7c44ca7fb78867ba46b233acdb59287e8c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ab669c2b44e1040ddfab7cd7f717aad580d17aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/263f7d61a4201cde16849b2d016251806e7418be"
        }
      ],
      "title": "usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90027",
    "datePublished": "2026-09-16T10:33:29.700Z",
    "dateReserved": "2026-09-11T19:38:34.782Z",
    "dateUpdated": "2026-09-16T14:41:43.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90027",
      "date": "2026-09-17",
      "epss": "0.00152",
      "percentile": "0.04734"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:14:37.000Z",
      "cve": "CVE-2026-90027",
      "id": "msrc_CVE-2026-90027",
      "initial_release_date": "2026-09-17T01:14:37.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90027.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-90027\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:17:15.723\",\"lastModified\":\"2026-09-16T15:18:26.043\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop\\n\\ncc_debounce_dwork is queued from the set_cc() and start_toggling()\\ncallbacks, which run from TCPM\u0027s kthread worker.  port_stop() returns\\nbefore tcpm_unregister_port() destroys that worker.  Flushing the worker\\nduring unregister may therefore run a callback which queues the delayed\\nwork after port_stop() has returned.\\n\\nThe delayed work can then run after devres has freed pmic_typec_port.\\n\\nUse disable_delayed_work_sync() in port_stop() to cancel a pending\\ninstance and prevent the TCPM callbacks from queueing another one.\\n\\nThis issue was found by an in-house static analysis tool.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a4422ff221429c600c3dc5d0394fb3738b89d040\",\"lessThan\":\"4359b5f95c93a4658e08368fa6fab9d89eb98447\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a4422ff221429c600c3dc5d0394fb3738b89d040\",\"lessThan\":\"c614d7c44ca7fb78867ba46b233acdb59287e8c8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a4422ff221429c600c3dc5d0394fb3738b89d040\",\"lessThan\":\"1ab669c2b44e1040ddfab7cd7f717aad580d17aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a4422ff221429c600c3dc5d0394fb3738b89d040\",\"lessThan\":\"263f7d61a4201cde16849b2d016251806e7418be\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ab669c2b44e1040ddfab7cd7f717aad580d17aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/263f7d61a4201cde16849b2d016251806e7418be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4359b5f95c93a4658e08368fa6fab9d89eb98447\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c614d7c44ca7fb78867ba46b233acdb59287e8c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.