CVE-2026-90027: usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop
ccdebouncedwork is queued from the setcc() and starttoggling() callbacks, which run from TCPM's kthread worker. portstop() returns before tcpmunregisterport() destroys that worker. Flushing the worker during unregister may therefore run a callback which queues the delayed work after portstop() has returned.
The delayed work can then run after devres has freed pmictypecport.
Use disabledelayedworksync() in portstop() to cancel a pending instance and prevent the TCPM callbacks from queueing another one.
This issue was found by an in-house static analysis tool.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the unsafe work scheduling?
The condition occurs during Type-C port shutdown when TCPM worker callbacks such as set_cc() or start_toggling() can queue cc_debounce_dwork after port_stop() has returned. The delayed work may then execute after the pmic_typec_port structure has been freed.
What component or configuration is affected?
The issue is in the Linux kernel qcom-pmic-typec driver, affecting Qualcomm PMIC Type-C port handling. The provided data does not identify affected kernel versions or indicate whether any particular hardware configuration enables the driver by default.
What mitigation is described if an update cannot be applied immediately?
The provided fix changes port_stop() to use disable_delayed_work_sync(), cancelling pending delayed work and preventing TCPM callbacks from queuing another instance during shutdown. No separate operational workaround is provided.