CVE-2026-98758
Received Received - Intake

Use-After-Free in Linux Kernel USB Type-C UCSI Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmic_glink client is released by the devres cleanup, which runs after pmic_glink_ucsi_remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi_unregister() has been called touches freed state: it dereferences the connector array that ucsi_unregister() freed, or registers and unregisters the instance a second time. Disable both work items with disable_work_sync() before unregistering, and unregister only if the instance is still registered. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98758
EUVD
EUVD-2026-103843

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad
Linux Linux 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad
Linux Linux 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad
Linux Linux 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad
Linux Linux 6.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's USB Type-C subsystem. It occurs when the pmic_glink client is released after the ucsi_remove function has already completed. This causes notification callbacks to queue work that runs after ucsi_unregister has freed memory, leading to dereferencing of freed state or double registration and unregistration of the instance.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB Type-C subsystem and cannot be detected via network scans or generic commands. It requires kernel-level inspection for the affected Type-C UCSI GLINK driver. Check kernel logs for errors related to ucsi or pmic_glink after unplugging USB Type-C devices. Look for use-after-free warnings or crashes in dmesg output.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior due to memory corruption. Attackers might exploit it to execute arbitrary code, escalate privileges, or cause denial-of-service conditions on affected systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's USB Type-C subsystem that could lead to system instability or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this vulnerability is patched. If immediate patching is not possible, avoid unplugging USB Type-C devices while the system is under heavy load or running critical processes. Monitor kernel logs for related errors as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98758. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart