CVE-2026-98760usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity. typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs. Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0a4c005bd1715d8b32a368ed5516a6ee7e603d18 before 4b6823ce0e548491cb9663303cba28e18d351096; from 0a4c005bd1715d8b32a368ed5516a6ee7e603d18 before 282be6ae8be791762740107c79cecf5121f66063; from 0a4c005bd1715d8b32a368ed5516a6ee7e603d18 before dac0c073c6ad5f1bbb5e9fea9023fc1b4dab5e14; from 0a4c005bd1715d8b32a368ed5516a6ee7e603d18 before c4b27b3605788bbf9e4251f3cd4ab94645ab036f | CNA record |
References
- https://git.kernel.org/stable/c/4b6823ce0e548491cb9663303cba28e18d351096
- https://git.kernel.org/stable/c/282be6ae8be791762740107c79cecf5121f66063
- https://git.kernel.org/stable/c/dac0c073c6ad5f1bbb5e9fea9023fc1b4dab5e14
- https://git.kernel.org/stable/c/c4b27b3605788bbf9e4251f3cd4ab94645ab036f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.