CVE-2026-64329

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel USB TypeC UCSI CCG Driver

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(), which on a connector-change event calls ucsi_connector_change() and schedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees uc->ucsi (kfree) before free_irq() is called, so a handler invocation already in flight may access the freed object after ucsi_destroy(). CPU 0 (remove) | CPU 1 (threaded IRQ) ucsi_destroy(uc->ucsi) | ccg_irq_handler() kfree(ucsi) // FREE | ucsi_notify_common(uc->ucsi) // USE Move free_irq() before ucsi_destroy() in the remove path. It is kept after ucsi_unregister(): ucsi_unregister() cancels connector work whose handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(), which waits for a completion that is signalled from the IRQ handler, so the IRQ must stay active until that work has been cancelled. The probe error path already orders free_irq() before ucsi_destroy(). This bug was found by static analysis.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64329

EUVD

EUVD-2026-48873

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 5.5 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's USB Type-C Subsystem (UCSI) driver for Cypress CCG controllers. It occurs when the driver's remove function frees the UCSI structure before disabling the interrupt handler, allowing a pending interrupt to access freed memory. The issue stems from incorrect cleanup order in ucsi_ccg_remove().

Detection Guidance

This vulnerability is specific to the Linux kernel's USB Type-C subsystem and cannot be detected via network scans. Check if your system runs a vulnerable kernel version with: uname -a. If the kernel version is below the patched version, the system is likely affected.

Impact Analysis

This could cause system crashes, memory corruption, or privilege escalation if exploited. A malicious actor might trigger a USB Type-C event to exploit the freed memory access. Systems using affected Linux kernel versions with Type-C ports are potentially vulnerable.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a use-after-free issue in the Linux kernel's USB Type-C subsystem that could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to the latest patched version. If immediate patching is not possible, avoid hot-unplugging USB Type-C devices to reduce the risk of triggering the use-after-free condition.

Hi! I’m here to help you understand CVE-2026-64329. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70