CVE-2026-90028usb: typec: hd3ss3220: track VBUS enable state per consumer
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulator_is_enabled() reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can skip its own regulator_enable() call and later attempt to drop a reference it never acquired, triggering an unbalanced regulator disable warning. Track successful enable and disable calls locally. Keep the state unchanged when an operation fails so a later role or ID notification retries the operation while this consumer keeps balanced references.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b3f9d6e491fda73c319547881b78cdd2a222b293 before df7cd3908e07503fa7e9737dacf44208530e58d9; from b3f9d6e491fda73c319547881b78cdd2a222b293 before c9a48db776d7184981630ecc01a3ad30a8f7dc24 | CNA record |
References
- https://git.kernel.org/stable/c/df7cd3908e07503fa7e9737dacf44208530e58d9
- https://git.kernel.org/stable/c/c9a48db776d7184981630ecc01a3ad30a8f7dc24
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.