CVE-2026-93225: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
In the Linux kernel, the following vulnerability has been resolved:
phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
If probe fails after imx95usbphygettca() succeeds, the typec switch leaks because the only cleanup path was in .remove(), which never runs on probe failure.
Use devmaddactionorreset() so the switch is cleaned up on both probe failure and driver removal. The imx95usbphyputtca() is no longer needed, it will be removed in .remove() too.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
When can this leak occur?
The leak occurs only when the fsl-imx8mq-usb PHY driver's probe operation fails after imx95_usb_phy_get_tca() has successfully obtained the Type-C switch. Normal driver removal was previously the only cleanup path, and it does not run after a failed probe.
What is the impact of the fix?
The driver now registers managed cleanup with devm_add_action_or_reset(), so the Type-C switch is released both if probing fails and when the driver is removed. The explicit imx95_usb_phy_put_tca() cleanup is no longer needed in the remove path.