CVE-2026-98760: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect()
tps6598xconnect() passes a stack-allocated typecpartnerdesc to typecregisterpartner() after initializing only usbpd, accessory and identity.
typecregisterpartner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typecpartnerlinkdevice() when a USB device is linked to the port. Uninitialized pdrevision and usbcapability similarly leak stack data through partner sysfs.
Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Linux kernel systems using the TPS6598x Type-C/USB-PD controller driver are exposed when that driver registers a connected Type-C partner. The issue is relevant when a USB device is linked to the affected Type-C port.
What could trigger the unsafe function-pointer use?
The affected path can store uninitialized attach and detach callback pointers in the Type-C partner object. Those pointers may later be invoked when typec_partner_link_device() links a USB device to the port.
Is sensitive information also exposed?
Yes. Uninitialized pd_revision and usb_capability fields can disclose stack data through the Type-C partner sysfs interface.
What does the fix change?
The fix zero-initializes the typec_partner_desc structure before it is passed to typec_register_partner(). This leaves optional callbacks as NULL and clears the fields that could otherwise expose stack contents.