EUVD-2026-103847

In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2wakeupdetected accesses the DWC2 host state and can rearm the wakeup timer. dwc2hcdfree currently deletes the timer only after freeing host-owned state, and timerdele...

CVE-2026-98762 USB: dwc2: shut down wakeup timer before freeing HCD state

In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2wakeupdetected accesses the DWC2 host state and can rearm the wakeup timer. dwc2hcdfree currently deletes the timer only after freeing host-owned state, and timerdele...

CVE-2026-98761

The Linux kernel contains a vulnerability in the usb: typec: tcpm component where the port fails to reset correctly after a failure to start the FAST_ROLE_SWAP AMS . When certain cables incorrectly signal an FRS during disconnection, the TCPC autonomously starts sourcing VBUS , but the sourcing r...

CVE-2026-98761 usb: typec: tcpm: recover after failure to start the frs ams

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FASTROLESWAP AMS by initiating error recovery on it. This helps in cases where some cables incorrectly signal an FRS to an...

CVE-2026-98761 usb: typec: tcpm: recover after failure to start the frs ams

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FASTROLESWAP AMS by initiating error recovery on it. This helps in cases where some cables incorrectly signal an FRS to an...

EUVD-2026-103846

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FASTROLESWAP AMS by initiating error recovery on it. This helps in cases where some cables incorrectly signal an FRS to an...

CVE-2026-98760

The Linux kernel contains a vulnerability in the usb: typec: tipd component where the tps6598x_connect() function passes a stack-allocated typec_partner_desc to typec_register_partner() without full initialization. Specifically, only usb_pd, accessory, and identity fields are set, leaving other f...

CVE-2026-98760 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartner...

EUVD-2026-103845

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartner...

CVE-2026-98760 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartner...

CVE-2026-98759 usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

CVE-2026-98759

The Linux kernel contains a vulnerability in the usb: typec: tipd component where cd321x_update_work() fails to fully initialize a stack-allocated typec_partner_desc before passing it to typec_register_partner(). This oversight allows garbage function pointers to be stored in the attach and deatt...

EUVD-2026-103844

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

CVE-2026-98759 usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

CVE-2026-98758 usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

CVE-2026-98758

The Linux kernel contains a use-after-free vulnerability in the usb: typec: ucsi: glink component. The issue occurs because the pmic_glink client is released by devres cleanup after pmic_glink_ucsi_remove() returns, allowing notification callbacks to queue work that touches freed state. Specifica...

EUVD-2026-103843

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

CVE-2026-98758 usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

CVE-2026-98757

The Linux kernel contains a use-after-free vulnerability in the cdns3 gadget driver. The issue originates in cdns3_gadget_exit(), which fails to wait for two specific works (pending_status_wq and aligned_buf_wq) queued on system_freezable_wq. Because the function proceeds to free endpoints, buffe...

CVE-2026-98757 usb: cdns3: fix use-after-free in cdns3_gadget_exit()

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...