All vulnerabilities
CVE-2026-98759

Linux: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in75dc6cb377efd2f4428b7f76d3a590a0bbc10399Also 5414144e202a32437e3eb436cd3f5f00d79ad86e, 88c7e458af53ff781a3f1051708395892b325576CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 75dc6cb377efd2f4428b7f76d3a590a0bbc10399LinuxCVE List
  • 5414144e202a32437e3eb436cd3f5f00d79ad86eLinuxCVE List
  • 88c7e458af53ff781a3f1051708395892b325576LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

cd321x_update_work() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity.

typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs.

Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.

Text from CVE List

Affected versions 8

  • Linuxaffected: 82432bbfb9e83b7e81d04660fe129b99a29b2ac2 before 75dc6cb377efd2f4428b7f76d3a590a0bbc10399CVE List
  • Linuxaffected: 82432bbfb9e83b7e81d04660fe129b99a29b2ac2 before 5414144e202a32437e3eb436cd3f5f00d79ad86eCVE List
  • Linuxaffected: 82432bbfb9e83b7e81d04660fe129b99a29b2ac2 before 88c7e458af53ff781a3f1051708395892b325576CVE List
  • Linuxaffected: 6.18CVE List
  • Linuxunaffected: all versions before 6.18CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3