CVE-2026-98759: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework()
cd321xupdatework() passes a stack-allocated typecpartnerdesc to typecregisterpartner() after initializing only usbpd, accessory and identity.
typecregisterpartner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typecpartnerlinkdevice() when a USB device is linked to the port. Uninitialized pdrevision and usbcapability similarly leak stack data through partner sysfs.
Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for the uninitialized callback pointers to be invoked?
The issue occurs when cd321x_update_work() registers a Type-C partner using a descriptor whose attach and deattach callback fields were not initialized. The stored garbage pointers may later be invoked when typec_partner_link_device() links a USB device to the port.
What information could be exposed even if the callback pointers are not invoked?
The uninitialized pd_revision and usb_capability fields can leak stack data through the Type-C partner sysfs attributes.
What does the fix change?
The fix zero-initializes the typec_partner_desc before it is passed to typec_register_partner(). This leaves optional callbacks as NULL and sets the remaining previously uninitialized fields to zero.