CVE-2026-53305: usb: typec: ps883x: Fix Oops at unbind
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ps883x: Fix Oops at unbind
When trying to unbind a device in order to bind to it vfio-platform as:
echo bc0000.geniqup > /sys/bus/platform/devices/bc0000.geniqup/driver/unbind
I get the following Oops:
[ 436.478639] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 [ 436.487762] Mem abort info: [ 436.490716] ESR = 0x0000000096000004 [ 436.494595] EC = 0x25: DABT (current EL), IL = 32 bits [ 436.500071] SET = 0, FnV = 0 [ 436.503250] EA = 0, S1PTW = 0 [ 436.506505] FSC = 0x04: level 0 translation fault [ 436.511533] Data abort info: [ 436.514558] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 436.520215] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 436.525436] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 436.530918] user pgtable: 4k pages, 48-bit VAs, pgdp=00000008861a9000 [ 436.537554] [0000000000000020] pgd=0000000000000000, p4d=0000000000000000 [ 436.544548] Internal error: Oops: 0000000096000004 [#1] SMP [ 436.550374] Modules linked in: [ 436.553542] CPU: 2 UID: 0 PID: 671 Comm: bash Tainted: G W 7.0.0-rc3-g56fcdd0911a5-dirty #2 PREEMPT [ 436.564440] Tainted: [W]=WARN [ 436.567515] Hardware name: LENOVO 91B6CTO1WW/3796, BIOS O6NKT3BA 05/02/2025 [ 436.574675] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 436.581841] pc : ps883xretimerremove+0x14/0x94 [ 436.586605] lr : i2cdeviceremove+0x28/0x84 [ 436.591017] sp : ffff8000847137c0
That's because the ps883xretimerremove() retrieves the driver data from i2cgetclientdata() which was never set at probe. So, add i2csetclientdata() at the end of the probe.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel usb: typec ps883xto a version that resolves this vulnerability.Fixed in 7.0.0-rc3-g56fcdd0911a5-dirty - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Fix Oops at unbind - Operational
After applying the kernel/ps883x fix, retry unbinding the device from its current driver and binding to vfio-platform; the original crash occurred at ps883x_retimer_remove() during unbind.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53305?
CVE-2026-53305 has a risk rating of 38 which indicates a moderate severity vulnerability.
How do I fix CVE-2026-53305?
To fix CVE-2026-53305, update your Linux kernel to include the latest patches that address this vulnerability.
What are the potential impacts of CVE-2026-53305?
CVE-2026-53305 can lead to a null pointer dereference which may cause a system crash or instability.
Which software versions are affected by CVE-2026-53305?
CVE-2026-53305 affects specific versions of the Linux kernel that are vulnerable to the identified issue.
Is CVE-2026-53305 actively exploited in the wild?
As of now, there are no reported active exploits for CVE-2026-53305.