CVE-2026-98759: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework()
cd321xupdatework() passes a stack-allocated typecpartnerdesc to typecregisterpartner() after initializing only usbpd, accessory and identity.
typecregisterpartner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typecpartnerlinkdevice() when a USB device is linked to the port. Uninitialized pdrevision and usbcapability similarly leak stack data through partner sysfs.
Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Zero-initialize the stack-allocated typec_partner_desc in cd321x_update_work() so pd_revision, usb_capability, optional callbacks, and remaining fields are initialized to zero or NULL before calling typec_register_partner().