All vulnerabilities
CVE-2026-98760

Linux: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4b6823ce0e548491cb9663303cba28e18d351096Also 282be6ae8be791762740107c79cecf5121f66063CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 4b6823ce0e548491cb9663303cba28e18d351096LinuxCVE List
  • 282be6ae8be791762740107c79cecf5121f66063LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity.

typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs.

Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.

Text from CVE List

Affected versions 12

  • Linuxaffected: 0a4c005bd1715d8b32a368ed5516a6ee7e603d18 before a39d53f70e637ff3970046c32106a0e64fca62cdCVE List
  • Linuxaffected: 0a4c005bd1715d8b32a368ed5516a6ee7e603d18 before 4b6823ce0e548491cb9663303cba28e18d351096CVE List
  • Linuxaffected: 0a4c005bd1715d8b32a368ed5516a6ee7e603d18 before 282be6ae8be791762740107c79cecf5121f66063CVE List
  • Linuxaffected: 0a4c005bd1715d8b32a368ed5516a6ee7e603d18 before dac0c073c6ad5f1bbb5e9fea9023fc1b4dab5e14CVE List
  • Linuxaffected: 0a4c005bd1715d8b32a368ed5516a6ee7e603d18 before c4b27b3605788bbf9e4251f3cd4ab94645ab036fCVE List
  • Linuxaffected: 4.15CVE List
  • Linuxunaffected: all versions before 4.15CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5