CVE-2026-64329: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64329 Overview

CVE-2026-64329 is a use-after-free vulnerability in the Linux kernel's USB Type-C UCSI (USB Type-C Connector System Software Interface) Cypress CCG (CCGx) driver. The flaw exists in the driver remove path, where ucsi_destroy() frees the uc->ucsi object via kfree() before free_irq() is called. A threaded IRQ handler already in flight can dereference the freed memory through ccg_irq_handler() and ucsi_notify_common(), producing a race between removal and interrupt handling. The issue was identified through static analysis and resolved by reordering free_irq() to run before ucsi_destroy() in the remove path.

Critical Impact
A race between driver unbind and an in-flight threaded USB Type-C IRQ can trigger kernel memory corruption, leading to potential denial of service or local privilege escalation on affected systems.

Affected Products

Linux kernel builds enabling CONFIG_TYPEC_UCSI with the Cypress CCG (ucsi_ccg) driver
Systems using Cypress CCGx USB Type-C PD controllers (common on NVIDIA Jetson and various x86 laptops)
Stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64329 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64329

Vulnerability Analysis

The defect resides in drivers/usb/typec/ucsi/ucsi_ccg.c within the ucsi_ccg_remove() teardown sequence. The remove path calls ucsi_destroy(), which invokes kfree() on the uc->ucsi structure while the threaded IRQ line remains registered. On another CPU, ccg_irq_handler() may still be executing and calls ucsi_notify_common(uc->ucsi). On a connector-change event, that path continues into ucsi_connector_change() and schedules connector work, all while dereferencing an object that has just been released.

The upstream fix moves free_irq() ahead of ucsi_destroy() in the remove path. However, free_irq() must remain after ucsi_unregister() because ucsi_unregister() cancels connector work whose handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(). That command waits for a completion signalled from the IRQ handler, so the interrupt must stay live until pending work is cancelled. The probe error path already applied this ordering; the remove path did not.

Root Cause

The root cause is an ordering defect between resource release and IRQ teardown. Freeing an object that is still reachable from an active threaded interrupt handler is a classic use-after-free pattern, mapped to [CWE-416]. The lifetime of uc->ucsi was not correctly bounded by IRQ deregistration.

Attack Vector

Exploitation requires local access and the ability to trigger driver unbind while USB Type-C connector activity generates interrupts. An attacker with permissions to unbind or reload the ucsi_ccg module, combined with connector state changes, can race the free against an in-flight IRQ handler. Successful racing corrupts kernel memory, which can cause a system crash or, with additional heap grooming, may be leveraged toward privilege escalation.

The vulnerability manifests only during the narrow window between ucsi_destroy() and IRQ deregistration. See the upstream commit references for the exact code changes that eliminate the race.

Detection Methods for CVE-2026-64329

Indicators of Compromise

Kernel oops or panic messages referencing ucsi_notify_common, ccg_irq_handler, or ucsi_connector_change in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the ucsi_ccg module
Unexpected module unload events for ucsi_ccg correlated with USB Type-C connector activity

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free deterministically during driver unbind testing
Audit kernel package versions against the fixed stable branches identified in the upstream commit list
Monitor for unauthorized rmmod, modprobe -r, or writes to /sys/bus/*/drivers/ucsi_ccg/unbind on production systems

Monitoring Recommendations

Forward kernel logs to a central SIEM and alert on oops or panic traces mentioning UCSI or CCG symbols
Track auditd events for module load and unload operations on endpoints containing Cypress CCG hardware
Baseline USB Type-C driver activity and flag anomalous unbind frequency, particularly on multi-user or shared workstations

How to Mitigate CVE-2026-64329

Immediate Actions Required

Update to a Linux kernel version containing the fix from the referenced stable commits, including 1a160076d3d0, 1f0bdc2884b6, 86c9ee928c4a, 99381e762273, c32df1114782, dbb500bad021, f1adeb1ff8be, and f5c772b76bbd
Inventory systems using Cypress CCGx USB Type-C controllers to prioritize patch deployment
Restrict local access and module management privileges to trusted administrators

Patch Information

The fix reorders free_irq() to execute before ucsi_destroy() in ucsi_ccg_remove(), while keeping it after ucsi_unregister() so that pending connector work can complete. Distribution vendors are backporting the change to supported stable branches. Refer to the Linux Kernel stable tree commit for the canonical patch.

Workarounds

Avoid unbinding or unloading the ucsi_ccg driver on production systems until patched
Blacklist ucsi_ccg on hosts that do not require USB Type-C PD functionality via a modprobe blacklist entry
Restrict CAP_SYS_MODULE and root-equivalent privileges to reduce the ability to trigger driver removal

bash

# Verify running kernel and inspect ucsi_ccg module status
uname -r
lsmod | grep ucsi_ccg

# Optional: prevent the driver from loading on unaffected systems until patched
echo 'blacklist ucsi_ccg' | sudo tee /etc/modprobe.d/blacklist-ucsi_ccg.conf
sudo update-initramfs -u