UBUNTU-CVE-2026-98759: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework() cd321xupdatework() passes a stack-allocated typecpartnerdesc to typecregisterpartner() after initializing only usbpd, accessory and identity. typecregisterpartner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typecpartnerlinkdevice() when a USB device is linked to the port. Uninitialized pdrevision and usbcapability similarly leak stack data through partner sysfs. Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Configuration
Zero-initialize the stack-allocated typec_partner_desc before passing it to typec_register_partner(), so pd_revision, usb_capability, and optional callbacks remain zero or NULL.
Linux kernel USB Type-C cd321x typec_partner_desc initialization in cd321x_update_work() = zero-initialized
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running one of the listed Ubuntu kernel packages are potentially affected if they use the TI TPS6598x/CD321x Type-C port controller driver and a USB device is linked to the affected Type-C port.
What conditions are required for exploitation?
The vulnerable update work must register a Type-C partner with uninitialized descriptor fields, and a USB device must subsequently be linked to that port. No privileges or user interaction are indicated by the supplied severity vector.
What is the impact of the uninitialized fields?
Uninitialized attach and detach callback fields can result in garbage function pointers being stored and later invoked. Uninitialized pd_revision and usb_capability fields can also disclose stack data through the Type-C partner sysfs interface.
What can be done if the kernel cannot be updated immediately?
The provided data identifies the affected Type-C controller driver but does not specify a supported workaround. Reducing use of affected Type-C ports or devices may reduce exposure until an updated kernel is deployed.