CVE-2026-90026: usb: typec: qcom-pmic: cancel reset_work on stop
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: qcom-pmic: cancel resetwork on stop
pdphystop() disables IRQs but leaves resetwork pending. If the IRQ handler schedules it just before disableirq(), the work runs after remove() frees the struct via devm.
Call cancelworksync() after disabling IRQs to close the window.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel usb: typec: qcom-pmic driver, call cancel_work_sync() after disabling IRQs in pdphy_stop() to cancel the pending reset_work before remove() frees the structure.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel Qualcomm PMIC USB Type-C driver are relevant. The race occurs during driver stop and device removal, when pending reset_work can run after the driver structure has been freed.
What condition is required for the race to occur?
An IRQ handler must schedule reset_work immediately before pdphy_stop() disables IRQs. Because the pending work was not canceled, it can execute after remove() frees the devm-managed structure.
What should be checked if an immediate update is not possible?
Check whether the deployed driver cancels reset_work synchronously after disabling IRQs in pdphy_stop(). The provided fix closes the race by calling cancel_work_sync() after IRQs are disabled.