CVE-2026-90026

CVE-2026-90026 is a use-after-free flaw in the Qualcomm PMIC USB Type-C driver (qcom-pmic) in the Linux kernel: the pdphy_stop() routine disables the PHY's IRQs but leaves a previously scheduled reset_work still pending. If the IRQ handler queues reset_work in the window just before disable_irq() is called, the work item can execute after the driver's remove() path has already freed its backing structure via the devm allocator, causing the work to operate on freed memory. A local attacker with low privileges (the CVSS vector is AV:L/PR:L) who can trigger driver stop/unbind races could gain kernel-level impact, with the CVSS indicating potential for high confidentiality, integrity, and availability impact (kernel memory corruption, crash, or possible local privilege escalation). Affected systems are Linux deployments on Qualcomm Snapdragon platforms where this driver is enabled, such as recent Android flagship handsets and Qualcomm-based ARM laptops. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; the bug was found by an in-house static analysis tool.

What to do: Apply the kernel update containing the fix commit that calls cancel_work_sync() after IRQs are disabled in pdphy_stop(), including the backport to your vendor's stable/maintained kernel branch (specific fixed version tags were not published in the available data). Device and OS vendors building kernels for Qualcomm Snapdragon platforms should verify the patch is included in their next release. Because exploitation requires local low-privileged code execution, avoid running untrusted local code/apps on affected devices until patched; no workarounds or in-the-wild exploitation are known.