CVE-2026-46134 Overview
CVE-2026-46134 is a Linux kernel vulnerability in the platform/chrome ChromeOS Embedded Controller Type-C driver (cros_ec_typec). The function cros_typec_register_thunderbolt() fails to initialize the adata->lock mutex during Thunderbolt registration. When the kernel later attempts to acquire the mutex, such as during cros_typec_altmode_work(), the operation triggers a NULL pointer dereference. The flaw has been resolved upstream by initializing the mutex within cros_typec_register_thunderbolt().
Critical Impact
An uninitialized mutex in the ChromeOS Type-C driver can trigger a kernel NULL pointer dereference during Thunderbolt alternate mode handling, leading to a kernel oops and local denial of service on affected systems.
Affected Products
- Linux kernel platform/chrome subsystem (cros_ec_typec driver)
- ChromeOS systems using the cros_ec Type-C controller with Thunderbolt support
- Linux distributions shipping kernels prior to the fix commits referenced below
Discovery Timeline
- 2026-05-28 - CVE-2026-46134 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46134
Vulnerability Analysis
The defect resides in the ChromeOS Embedded Controller Type-C driver located in the kernel platform/chrome subsystem. The driver manages USB Type-C port state, including alternate modes such as Thunderbolt. During Thunderbolt registration, the driver allocates an adata structure and registers an alternate mode device, but it omits the call required to initialize the embedded lock mutex.
Later code paths assume the mutex is fully constructed. The work handler cros_typec_altmode_work() acquires adata->lock to serialize alternate mode operations. Acquiring an uninitialized mutex dereferences invalid internal pointers, producing a NULL pointer dereference in the kernel mutex implementation. The result is a kernel oops that disrupts driver operation and can panic the affected task.
Root Cause
The root cause is a missing mutex_init() call on adata->lock inside cros_typec_register_thunderbolt(). The peer registration paths for other alternate modes correctly initialize the mutex, but the Thunderbolt path was omitted. This is a kernel-level Null Pointer Dereference flaw [CWE-476] combined with improper initialization.
Attack Vector
Triggering the flaw requires the affected kernel to register a Thunderbolt alternate mode through the cros_ec_typec driver, after which scheduled alternate mode work attempts to lock the uninitialized mutex. Exploitation conditions are local and dependent on hardware presence, specifically ChromeOS-class systems exposing Thunderbolt over USB Type-C through the embedded controller. No network attack vector or authentication bypass is involved; the practical impact is a local denial of service via kernel oops.
The upstream fix adds the missing mutex initialization. Refer to the kernel commits 23ae72e, 3b13d58, and 525cb7b for the patch details.
Detection Methods for CVE-2026-46134
Indicators of Compromise
- Kernel oops or BUG messages referencing cros_typec_altmode_work, cros_typec_register_thunderbolt, or __mutex_lock in dmesg and journal logs.
- NULL pointer dereference traces originating in the platform/chrome subsystem on systems with USB Type-C Thunderbolt hardware.
- Repeated cros_ec_typec driver failures or port state errors after Thunderbolt device insertion.
Detection Strategies
- Audit running kernel versions across ChromeOS and Linux fleets and compare against the fixed commit hashes referenced in the kernel.org advisories.
- Parse kernel crash logs for stack traces containing cros_typec_* symbols paired with mutex lock functions.
- Correlate USB Type-C and Thunderbolt hotplug events with subsequent kernel error messages to identify trigger conditions.
Monitoring Recommendations
- Forward dmesg, journalctl -k, and /var/log/kern.log to a centralized logging system for kernel oops detection.
- Alert on kernel panic and oops events that include cros_ec_typec driver symbols.
- Track package and kernel version inventory to confirm patched builds are deployed across affected endpoints.
How to Mitigate CVE-2026-46134
Immediate Actions Required
- Update affected Linux kernels to a version containing the upstream fix commits 23ae72e, 3b13d58, and 525cb7b.
- Apply vendor-supplied stable kernel updates from your distribution maintainer as soon as they are available.
- Reboot updated systems to ensure the patched kernel image is active.
Patch Information
The Linux kernel maintainers resolved the issue by adding mutex_init() for adata->lock inside cros_typec_register_thunderbolt(). The fix is available in stable kernel trees through the commits listed above. Linux distribution vendors will integrate these commits into their stable kernel packages; consult your distribution's security advisories for the corresponding package versions.
Workarounds
- Disable Thunderbolt alternate mode support on affected ChromeOS or Linux systems where the patched kernel cannot yet be deployed.
- Avoid hot-plugging Thunderbolt devices on USB Type-C ports managed by the unpatched cros_ec_typec driver.
- Restrict physical access to affected systems, since triggering the flaw requires local hardware interaction with Type-C ports.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
