All vulnerabilities
CVE-2026-98758

Linux: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in432b58cd959e594909a581b4974396cdbc9d4ca1Also 41934f92e7a54d4080ac0b17aacc83224946785c, 63b269ec537dc0fd26d0bd64872c26860d108c9dCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 432b58cd959e594909a581b4974396cdbc9d4ca1LinuxCVE List
  • 41934f92e7a54d4080ac0b17aacc83224946785cLinuxCVE List
  • 63b269ec537dc0fd26d0bd64872c26860d108c9dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

The pmic_glink client is released by the devres cleanup, which runs after pmic_glink_ucsi_remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi_unregister() has been called touches freed state: it dereferences the connector array that ucsi_unregister() freed, or registers and unregisters the instance a second time.

Disable both work items with disable_work_sync() before unregistering, and unregister only if the instance is still registered.

This issue was found by an in-house static analysis tool.

Text from CVE List

Affected versions 10

  • Linuxaffected: 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad before 432b58cd959e594909a581b4974396cdbc9d4ca1CVE List
  • Linuxaffected: 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad before 41934f92e7a54d4080ac0b17aacc83224946785cCVE List
  • Linuxaffected: 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad before ee8577de01c6b6c7dd1d76b52242c54d37a989f4CVE List
  • Linuxaffected: 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad before 63b269ec537dc0fd26d0bd64872c26860d108c9dCVE List
  • Linuxaffected: 6.4CVE List
  • Linuxunaffected: all versions before 6.4CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4