CVE-2026-68372: usb: core: port: Deattach Type-C connector on component unbind
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Configuration
Update connector_unbind() to call typec_deattach() before clearing port_dev->connector, matching connector_bind() and ensuring port->usb2_dev and port->usb3_dev are cleared safely.
Linux kernel usb core port connector_unbind() Type-C connector detachment before connector clearing = Call typec_deattach() before setting port_dev->connector = NULL
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68372?
The severity of CVE-2026-68372 is classified as risk 37.
What type of vulnerability is identified in CVE-2026-68372?
CVE-2026-68372 is categorized as a use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2026-68372?
To fix CVE-2026-68372, users should update to the patched version of the Linux kernel that addresses this vulnerability.
What component is affected by CVE-2026-68372?
CVE-2026-68372 specifically affects the USB core and Type-C connector handling in the Linux kernel.
When was CVE-2026-68372 published?
CVE-2026-68372 was published on August 10, 2026.