CVE-2026-100079: usb: typec: ucsi: unregister debugfs entries on teardown
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: unregister debugfs entries on teardown
ucsiregister() creates per-instance debugfs entries, but ucsiunregister() keeps them around until ucsidestroy().
Drivers like ucsiglink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory and log:
debugfs: 'pmicglink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsiunregister(), and clear ucsi->debugfs after freeing it so repeated unregister paths remain safe.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems using the Linux UCSI Type-C subsystem with drivers that unregister and re-register the same UCSI instance are affected. The description specifically identifies ucsi_glink during remoteproc restart as an example.
What operational symptom indicates that a system is affected?
A repeated registration can fail to create its debugfs directory and log a message such as: debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'. This occurs because per-instance debugfs entries remain after UCSI unregister.
What does the fix change?
The fix unregisters debugfs entries during ucsi_unregister() rather than retaining them until ucsi_destroy(). It also clears the ucsi->debugfs pointer after freeing the entries so repeated unregister paths are safe.