CVE-2026-53305: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53305 Overview

CVE-2026-53305 is a NULL pointer dereference vulnerability in the Linux kernel's USB Type-C ps883x retimer driver. The flaw triggers a kernel Oops when an administrator attempts to unbind the driver from a device, for example to rebind it to vfio-platform. The ps883x_retimer_remove() function retrieves driver data via i2c_get_clientdata(), but the corresponding i2c_set_clientdata() call was never made during probe. Dereferencing the resulting NULL pointer causes a kernel-mode fault in the removal path.

Critical Impact
Local privileged users can trigger a kernel Oops and denial of service on affected Linux systems by unbinding the ps883x retimer driver.

Affected Products

Linux kernel builds including the USB Type-C ps883x retimer driver
Platforms shipping the Parade PS883x USB Type-C retimer (including ARM64 laptops such as certain Lenovo models)
Distributions consuming affected mainline and stable kernel branches prior to the fix commits

Discovery Timeline

2026-06-26 - CVE-2026-53305 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53305

Vulnerability Analysis

The vulnerability resides in the ps883x USB Type-C retimer driver within the Linux kernel. During probe, the driver never calls i2c_set_clientdata() to associate its private driver structure with the underlying I2C client. When the driver is later removed, ps883x_retimer_remove() calls i2c_get_clientdata() and receives NULL. The remove routine then dereferences that pointer at offset 0x20, producing the observed data abort: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020.

The fault occurs in kernel context on the i2c_device_remove() code path, resulting in an Internal Error / Oops and process termination. The condition is deterministic and reachable through the standard sysfs unbind interface at /sys/bus/platform/devices/<device>/driver/unbind, which requires root privileges.

Root Cause

The root cause is a missing i2c_set_clientdata() call at the end of the ps883x probe routine. Without it, the driver-private context is never registered against the I2C client. The .remove callback assumes the pointer is valid and dereferences it, classifying the flaw as a NULL pointer dereference in a kernel driver.

Attack Vector

Exploitation requires local access with sufficient privileges to write to sysfs driver bind and unbind attributes, typically root. Any workflow that unbinds the ps883x driver, including rebinding to vfio-platform for device passthrough, triggers the Oops. The impact is denial of service through a kernel fault rather than remote code execution. No public proof-of-concept exploit or CISA KEV entry is associated with this CVE.

The upstream fix adds an i2c_set_clientdata() call at the end of the probe function so that ps883x_retimer_remove() retrieves a valid pointer. Technical details are available in the referenced kernel git commits.

Detection Methods for CVE-2026-53305

Indicators of Compromise

Kernel log entries containing Unable to handle kernel NULL pointer dereference with pc : ps883x_retimer_remove in the call trace.
Internal error: Oops messages correlated with i2c_device_remove on systems with USB Type-C retimer hardware.
Unexpected process termination or system instability following writes to driver/unbind sysfs entries for ps883x devices.

Detection Strategies

Inventory running kernels and identify hosts loading the ps883x module, comparing kernel versions against the fix commits 37a3d1b68277, 381133848a03, and c404d0ac0cb0.
Monitor dmesg and journalctl -k output for Oops signatures referencing ps883x_retimer_remove.
Alert on writes to /sys/bus/platform/devices/*/driver/unbind on production hosts where such operations are not expected.

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized logging system and create detections for Oops and ps883x co-occurrence.
Track sysfs bind/unbind activity via auditd rules on driver control paths.
Review kernel crash dumps and kdump output for repeated faults tied to USB Type-C retimer removal.

How to Mitigate CVE-2026-53305

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix referenced by commits 37a3d1b68277, 381133848a03, and c404d0ac0cb0.
Restrict write access to /sys/bus/platform/devices/*/driver/unbind to trusted administrators only.
Avoid unbinding the ps883x retimer driver on unpatched kernels until the fix is applied.

Patch Information

The fix adds i2c_set_clientdata() at the end of the ps883x probe function so that ps883x_retimer_remove() obtains a valid driver context. Consult the upstream commits: ps883x fix 37a3d1b68277, ps883x fix 381133848a03, and ps883x fix c404d0ac0cb0. Apply the patched kernel provided by your distribution vendor.

Workarounds

Do not unbind the ps883x driver via sysfs on unpatched systems, including workflows that rebind the device to vfio-platform.
Blacklist the ps883x module on hosts that do not require USB Type-C retimer functionality to remove the vulnerable code path.
Enforce least privilege so that only trusted operators can interact with driver bind/unbind attributes.

bash

# Example: prevent the ps883x module from loading on unpatched hosts
echo 'blacklist ps883x' | sudo tee /etc/modprobe.d/ps883x-blacklist.conf
sudo update-initramfs -u