CVE-2026-98760

Received Received - Intake

USB Type-C Partner Descriptor Uninitialized Memory in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity. typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs. Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98760

EUVD

EUVD-2026-103845

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0a4c005bd1715d8b32a368ed5516a6ee7e603d18
Linux	Linux	0a4c005bd1715d8b32a368ed5516a6ee7e603d18
Linux	Linux	0a4c005bd1715d8b32a368ed5516a6ee7e603d18
Linux	Linux	0a4c005bd1715d8b32a368ed5516a6ee7e603d18
Linux	Linux	4.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's USB Type-C driver (tipd). It involves a function tps6598x_connect() that fails to fully initialize a partner descriptor before passing it to typec_register_partner(). This leaves some fields uninitialized, which can lead to garbage function pointers being stored and later invoked when a USB device is linked to the port.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB Type-C subsystem and requires kernel-level inspection. Check if your system uses the affected tps6598x driver by running lsmod | grep tps6598x. If loaded, verify kernel logs for typec or USB Type-C errors with dmesg | grep typec or journalctl -k | grep typec.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a system crash by exploiting uninitialized memory in the USB Type-C driver. It may also leak sensitive information through uninitialized fields in the partner sysfs.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue involving uninitialized memory in USB Type-C partner descriptors, which could lead to memory corruption or undefined behavior in the Linux kernel. There is no evidence it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-98760. If immediate patching is not possible, disable the tps6598x driver by blacklisting it in /etc/modprobe.d/ to prevent exploitation until a permanent fix is applied.

Hi! I’m here to help you understand CVE-2026-98760. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70