CVE-2026-98758usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmic_glink client is released by the devres cleanup, which runs after pmic_glink_ucsi_remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi_unregister() has been called touches freed state: it dereferences the connector array that ucsi_unregister() freed, or registers and unregisters the instance a second time. Disable both work items with disable_work_sync() before unregistering, and unregister only if the instance is still registered. This issue was found by an in-house static analysis tool.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad before 432b58cd959e594909a581b4974396cdbc9d4ca1; from 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad before 41934f92e7a54d4080ac0b17aacc83224946785c; from 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad before ee8577de01c6b6c7dd1d76b52242c54d37a989f4; from 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad before 63b269ec537dc0fd26d0bd64872c26860d108c9d | CNA record |
References
- https://git.kernel.org/stable/c/432b58cd959e594909a581b4974396cdbc9d4ca1
- https://git.kernel.org/stable/c/41934f92e7a54d4080ac0b17aacc83224946785c
- https://git.kernel.org/stable/c/ee8577de01c6b6c7dd1d76b52242c54d37a989f4
- https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.