CVE-2026-93225

Received Received - Intake

Memory Leak in Linux Kernel USB PHY Driver

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95_usb_phy_get_tca() succeeds, the typec switch leaks because the only cleanup path was in .remove(), which never runs on probe failure. Use devm_add_action_or_reset() so the switch is cleaned up on both probe failure and driver removal. The imx95_usb_phy_put_tca() is no longer needed, it will be removed in .remove() too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-09-25

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-93225

EUVD

EUVD-2026-86228

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's phy: fsl-imx8mq-usb driver. It involves a memory leak in the typec switch when probe fails after a specific function succeeds. The cleanup path was only in the remove function, which doesn't run on probe failure. The fix uses devm_add_action_or_reset() to ensure cleanup on both probe failure and driver removal.

Detection Guidance

This vulnerability is specific to the Linux kernel's phy: fsl-imx8mq-usb driver and does not have network-based detection methods. It can only be detected by checking the kernel version and driver state on affected systems.

Impact Analysis

This vulnerability could lead to resource leaks in systems using the affected Linux kernel driver. While not directly exploitable for code execution, it may cause memory or switch leaks, potentially leading to system instability or degraded performance over time in embedded systems using the imx8mq-usb phy.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory/resource leak in the Linux kernel's USB PHY driver for i.MX8MQ devices, which could lead to resource exhaustion but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel logs for probe failures in the fsl-imx8mq-usb driver after updating.

Hi! I’m here to help you understand CVE-2026-93225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70