CVE-2026-90026: usb: typec: qcom-pmic: cancel reset_work on stop
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: qcom-pmic: cancel resetwork on stop
pdphystop() disables IRQs but leaves resetwork pending. If the IRQ handler schedules it just before disableirq(), the work runs after remove() frees the struct via devm.
Call cancelworksync() after disabling IRQs to close the window.
This issue was found by an in-house static analysis tool.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel Qualcomm PMIC USB Type-C driver are relevant. The race occurs during driver stop and device removal, when pending reset_work can run after the driver structure has been freed.
What condition is required for the race to occur?
An IRQ handler must schedule reset_work immediately before pdphy_stop() disables IRQs. Because the pending work was not canceled, it can execute after remove() frees the devm-managed structure.
What should be checked if an immediate update is not possible?
Check whether the deployed driver cancels reset_work synchronously after disabling IRQs in pdphy_stop(). The provided fix closes the race by calling cancel_work_sync() after IRQs are disabled.