CVE-2026-90027

A use-after-free race condition exists in the Linux kernel's Qualcomm PMIC USB Type-C port controller driver (usb: typec: qcom-pmic-typec). When a Type-C port is stopped, the cc_debounce delayed work can still be re-queued by TCPM callbacks (set_cc and start_toggling) running in TCPM's worker thread, because port_stop() returns before tcpm_unregister_port() destroys that worker; the delayed work can then execute after devres has freed the pmic_typec_port memory. A local attacker who can trigger Type-C port bring-up/teardown, such as rapid plug/unplug cycles or unbinding the device, could cause kernel memory corruption, leading to a crash or potentially privilege escalation (CVSS 7.8, high C/I/A, local attack vector). Only Linux systems running on Qualcomm Snapdragon-class platforms with this driver enabled are affected. No public proof-of-concept or in-the-wild exploitation is known; the flaw was found by static analysis and is not listed in CISA KEV.

What to do: Update to a kernel release that includes the upstream fix, which changes port_stop() to use disable_delayed_work_sync(); specific fixed version numbers were not listed in the advisory. Check whether your kernels enable CONFIG_TYPEC_QCOM_PMIC / qcom-pmic-typec and run on Qualcomm hardware, and prioritize patching multi-user systems where local users could trigger Type-C port re-registration. As an interim mitigation, restrict unprivileged local access and avoid unbinding or repeatedly re-registering the affected Type-C port.