CVE-2026-98760: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect()
tps6598xconnect() passes a stack-allocated typecpartnerdesc to typecregisterpartner() after initializing only usbpd, accessory and identity.
typecregisterpartner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typecpartnerlinkdevice() when a USB device is linked to the port. Uninitialized pdrevision and usbcapability similarly leak stack data through partner sysfs.
Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In tps6598x_connect(), zero-initialize the stack-allocated typec_partner_desc before passing it to typec_register_partner(), so pd_revision and usb_capability and all optional callback fields remain zero/NULL.