CVE-2026-90028: usb: typec: hd3ss3220: track VBUS enable state per consumer
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: hd3ss3220: track VBUS enable state per consumer
regulatorisenabled() reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can skip its own regulatorenable() call and later attempt to drop a reference it never acquired, triggering an unbalanced regulator disable warning.
Track successful enable and disable calls locally. Keep the state unchanged when an operation fails so a later role or ID notification retries the operation while this consumer keeps balanced references.
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The HD3SS3220 Type-C driver must share its VBUS regulator with another consumer that enables VBUS first. A subsequent role or ID notification can then cause this driver to skip acquiring its own enable reference and later attempt an unbalanced disable.
What is the practical impact of the flawed regulator-state handling?
The driver can trigger an unbalanced regulator disable warning by trying to drop a regulator enable reference it never acquired. The resolved behavior instead tracks successful enable and disable operations locally and preserves state after failures so later notifications retry the operation.
How can systems be identified as exposed?
Look for systems using the Linux kernel HD3SS3220 USB Type-C driver where VBUS is shared with another regulator consumer. Kernel logs containing an unbalanced regulator disable warning during Type-C role or ID changes are an indicator that the condition has occurred.
What mitigation is available if the fix cannot be applied immediately?
The provided information does not identify a configuration workaround. Reducing or avoiding situations in which another consumer enables the shared VBUS regulator before the HD3SS3220 driver handles a role or ID notification may avoid the described trigger, but this is not stated as a supported mitigation.