CVE-2026-90026usb: typec: qcom-pmic: cancel reset_work on stop
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel reset_work on stop pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ handler schedules it just before disable_irq(), the work runs after remove() frees the struct via devm. Call cancel_work_sync() after disabling IRQs to close the window. This issue was found by an in-house static analysis tool.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a4422ff221429c600c3dc5d0394fb3738b89d040 before 0b69b166852dbf1f9532b22bd49f502e5970eb95; from a4422ff221429c600c3dc5d0394fb3738b89d040 before b9a7eed472edbfa8dec0fdeafd5e796550a8a8b7; from a4422ff221429c600c3dc5d0394fb3738b89d040 before d4e00a1eb39174e25ef759b8fb1111bba8e87b1e; from a4422ff221429c600c3dc5d0394fb3738b89d040 before 52d556f08547733948cc40b8b11e6b68dccee7b2; from a4422ff221429c600c3dc5d0394fb3738b89d040 before 7b0df6efd143f8085bdb68778a013a46f1349913 | CNA record |
References
- https://git.kernel.org/stable/c/0b69b166852dbf1f9532b22bd49f502e5970eb95
- https://git.kernel.org/stable/c/b9a7eed472edbfa8dec0fdeafd5e796550a8a8b7
- https://git.kernel.org/stable/c/d4e00a1eb39174e25ef759b8fb1111bba8e87b1e
- https://git.kernel.org/stable/c/52d556f08547733948cc40b8b11e6b68dccee7b2
- https://git.kernel.org/stable/c/7b0df6efd143f8085bdb68778a013a46f1349913
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.