CVE-2026-100079: usb: typec: ucsi: unregister debugfs entries on teardown
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: unregister debugfs entries on teardown
ucsiregister() creates per-instance debugfs entries, but ucsiunregister() keeps them around until ucsidestroy().
Drivers like ucsiglink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory and log:
debugfs: 'pmicglink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsiunregister(), and clear ucsi->debugfs after freeing it so repeated unregister paths remain safe.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Update ucsi_unregister() to unregister per-instance debugfs entries during teardown, then clear ucsi->debugfs after freeing it so repeated unregister paths remain safe.
Linux kernel USB Type-C UCSI ucsi_unregister() debugfs teardown = Unregister debugfs entries and clear ucsi->debugfs after freeing it
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems using the Linux UCSI Type-C subsystem with drivers that unregister and re-register the same UCSI instance are affected. The description specifically identifies ucsi_glink during remoteproc restart as an example.
What operational symptom indicates that a system is affected?
A repeated registration can fail to create its debugfs directory and log a message such as: debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'. This occurs because per-instance debugfs entries remain after UCSI unregister.
What does the fix change?
The fix unregisters debugfs entries during ucsi_unregister() rather than retaining them until ucsi_destroy(). It also clears the ucsi->debugfs pointer after freeing the entries so repeated unregister paths are safe.