CVE-2026-98768: usb: typec: anx7411 - stop the IRQ before destroying the workqueue
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: anx7411 - stop the IRQ before destroying the workqueue
The IRQ is devm-managed, so it can still queue plat->work while remove() is tearing the queue down. Disable it first.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Stop or disable the IRQ before destroying the workqueue during remove().
Linux kernel usb: typec: anx7411 IRQ = disabled
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the ANX7411 USB Type-C driver are relevant. The issue is triggered during driver removal, when its devm-managed IRQ can still queue work as the workqueue is being destroyed.
What must occur for the race condition to be triggered?
The ANX7411 driver's remove path must be running while its IRQ remains enabled. An interrupt arriving in that window can queue plat->work after teardown of the workqueue has begun.
What is the mitigation if an updated kernel cannot be deployed immediately?
The provided data identifies disabling the IRQ before destroying the workqueue as the required fix. No separate operational workaround or configuration-based mitigation is provided.