CVE-2026-53028: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53028 Overview

CVE-2026-53028 is a Linux kernel vulnerability in the USB Type-C tipd driver (drivers/usb/typec/tipd/core.c). The flaw resides in cd321x_update_work(), where the return value of typec_register_partner() is checked for an error pointer but the function continues executing and dereferences the same pointer a few lines later. The defect was detected by the Smatch static analyzer and has been resolved upstream. The vulnerability affects kernel builds that include the Texas Instruments TPS6598x / CD321x Type-C Power Delivery driver.

Critical Impact
An error pointer dereference in kernel context can trigger a kernel oops or panic, resulting in denial of service when USB Type-C partner registration fails.

Affected Products

Linux kernel drivers/usb/typec/tipd/core.c (TI TPS6598x / CD321x Type-C PD driver)
Stable kernel branches prior to the commits listed in the patch references
Distributions shipping the affected tipd driver with USB Type-C support

Discovery Timeline

2026-06-24 - CVE-2026-53028 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53028

Vulnerability Analysis

The defect is a null/error pointer dereference [CWE-476] in the kernel USB Type-C Port Controller driver. Inside cd321x_update_work(), the driver calls typec_register_partner(tps->port, &desc) and assigns the result to tps->partner. The code then validates the assignment with IS_ERR(tps->partner) and logs a warning via dev_warn(), but it omits the corresponding return statement.

Execution continues into the following block, which checks desc.identity and then calls typec_partner_set_identity(tps->partner). Because tps->partner still holds the ERR_PTR value, the helper dereferences an invalid kernel pointer. The same pointer is also assigned to cd321x->cur_partner_identity, propagating the corrupted state.

The upstream fix adds an early return after the warning and corrects a spelling error in the log message (partnet → partner). See the patch commits 19951118fb22, 9e31082f92c9, and f2529d08fcb4 for details.

Root Cause

The root cause is missing control-flow termination after an error condition check. The author treated IS_ERR() as a warning-only path instead of a failure path. Static analysis by Smatch flagged the issue at drivers/usb/typec/tipd/core.c:827 with the message 'tps->partner' dereferencing possible ERR_PTR().

Attack Vector

Triggering the bug requires typec_register_partner() to fail, which can occur under memory pressure or specific Type-C partner negotiation conditions when a USB-C device is attached. A local attacker with the ability to attach USB-C hardware, or to induce allocation failures in the kernel, could reach the faulty path. Successful exploitation results in a kernel oops affecting system availability rather than code execution.

The vulnerability manifests in the partner registration handler. Refer to the upstream kernel commits for the exact diff and remediation logic.

Detection Methods for CVE-2026-53028

Indicators of Compromise

Kernel log entries containing failed to register partnet originating from the tipd driver
Kernel oops or BUG: unable to handle kernel paging request traces referencing cd321x_update_work or typec_partner_set_identity
Unexpected USB Type-C subsystem instability following device attach events

Detection Strategies

Run Smatch or Coccinelle static analysis against custom kernel trees to flag IS_ERR() checks lacking an early return
Compare installed kernel build IDs against the patched stable commits referenced in the kernel git log
Inspect dmesg and journalctl -k for tipd warnings followed by call traces

Monitoring Recommendations

Forward kernel crash logs and kdump output to a centralized logging platform for correlation
Alert on repeated kernel oops events that include tipd or typec_ symbols in the backtrace
Track package versions of linux-image-* across the fleet to confirm patch deployment

How to Mitigate CVE-2026-53028

Immediate Actions Required

Update affected Linux kernels to a stable release that incorporates the upstream tipd fix
Identify systems running the tipd driver by checking lsmod | grep tps6598x and inventory exposed hardware
Restrict physical USB-C access on systems that cannot be patched immediately

Patch Information

The fix is committed to the mainline and stable kernel trees in 19951118fb22b5ad512379ee64510fe0e2c40eb3, 9e31082f92c913d74fefb4e60cd0284e605ba3a3, and f2529d08fcb429ea01bb87c326342f41483f8b2f. The patch adds the missing early return after the IS_ERR() check and fixes the misspelled log string. Apply the corresponding distribution kernel update once it is published by your vendor.

Workarounds

Unload the tps6598x module with modprobe -r tps6598x on systems that do not require Type-C PD controller support
Blacklist the tipd driver via /etc/modprobe.d/ where USB-C PD functionality is not needed
Limit physical access to USB-C ports on critical systems until the patched kernel is deployed

bash

# Configuration example: blacklist the tipd driver until patched
echo 'blacklist tps6598x' | sudo tee /etc/modprobe.d/blacklist-tipd.conf
sudo modprobe -r tps6598x
sudo update-initramfs -u