CVE-2026-90027: usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop
ccdebouncedwork is queued from the setcc() and starttoggling() callbacks, which run from TCPM's kthread worker. portstop() returns before tcpmunregisterport() destroys that worker. Flushing the worker during unregister may therefore run a callback which queues the delayed work after portstop() has returned.
The delayed work can then run after devres has freed pmictypecport.
Use disabledelayedworksync() in portstop() to cancel a pending instance and prevent the TCPM callbacks from queueing another one.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Use disable_delayed_work_sync() in port_stop() to cancel pending cc_debounce_dwork instances and prevent TCPM callbacks from queueing another instance before tcpm_unregister_port() destroys the worker.
Linux kernel usb: typec: qcom-pmic-typec cc_debounce_dwork = disabled on stop
Event History
Frequently Asked Questions
What condition triggers the unsafe work scheduling?
The condition occurs during Type-C port shutdown when TCPM worker callbacks such as set_cc() or start_toggling() can queue cc_debounce_dwork after port_stop() has returned. The delayed work may then execute after the pmic_typec_port structure has been freed.
What component or configuration is affected?
The issue is in the Linux kernel qcom-pmic-typec driver, affecting Qualcomm PMIC Type-C port handling. The provided data does not identify affected kernel versions or indicate whether any particular hardware configuration enables the driver by default.
What mitigation is described if an update cannot be applied immediately?
The provided fix changes port_stop() to use disable_delayed_work_sync(), cancelling pending delayed work and preventing TCPM callbacks from queuing another instance during shutdown. No separate operational workaround is provided.