CVE-2026-64463 Overview
CVE-2026-64463 is a Linux kernel vulnerability in the USB Type-C Port Controller Interface (TCPCI) driver for the Richtek RT1711H chip. The flaw resides in the rt1711h_probe() function within drivers/usb/typec/tcpm/tcpci_rt1711h.c. The probe routine registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If those subsequent steps fail, the function returns without unregistering the port, leaving stale state referenced by the kernel. Local attackers with the ability to trigger probe failures can exploit this cleanup gap to affect confidentiality, integrity, and availability on the affected system.
Critical Impact
Improper resource cleanup in the RT1711H TCPCI probe path can lead to a stale port registration, enabling local privilege-context corruption of USB Type-C subsystem state.
Affected Products
- Linux kernel builds that include the tcpci_rt1711h USB Type-C driver
- Systems using Richtek RT1711H USB Type-C Port Controllers
- Distributions consuming stable kernel branches prior to the fixes referenced in commits 569f18a, 94b1abf, ce2e36e, e5406c8, and e8da46d
Discovery Timeline
- 2026-07-25 - CVE-2026-64463 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64463
Vulnerability Analysis
The defect is a resource management flaw in the Linux kernel USB Type-C stack. The rt1711h_probe() function calls tcpci_register_port() early in its initialization sequence. It then proceeds to request an IRQ and enable alert interrupts on the hardware. If either the interrupt request or the alert enable step fails, rt1711h_probe() returns an error to the driver core without calling tcpci_unregister_port(). The explicit unregister only executes from the driver's remove callback, which is not invoked when probe itself fails.
The result is a partially initialized TCPCI port left registered in the kernel's Type-C Port Manager (TPM) subsystem. The fix registers a devres (device-managed resource) action immediately after tcpci_register_port() succeeds. This causes tcpci_unregister_port() to run automatically on later probe failures and on driver detach. The remove callback is dropped to avoid double-unregistration of the same port.
Root Cause
The root cause is improper cleanup of a registered kernel resource along an error path in rt1711h_probe(). The probe function did not use the device-managed resource (devres) framework to tie the lifetime of the TCPCI port registration to the underlying device. This left an ordering gap between resource acquisition and error handling.
Attack Vector
Exploitation requires local access with low privileges on a system that loads the tcpci_rt1711h driver. An attacker who can induce probe failure conditions on the RT1711H device path can trigger the improper cleanup. The USB Type-C subsystem then retains references to freed or partially initialized structures. This is not a network-reachable vulnerability, and user interaction is not required.
No public proof-of-concept exploit is available. See the upstream fix commits for technical details on the corrected cleanup sequence: Kernel Git Commit 569f18a and Kernel Git Commit e8da46d.
Detection Methods for CVE-2026-64463
Indicators of Compromise
- Kernel log entries showing repeated failures of rt1711h_probe() followed by warnings about duplicate TCPCI port registration
- Unexpected WARN_ON or BUG traces referencing tcpci_register_port or tcpm_register_port in dmesg output
- USB Type-C ports becoming non-functional after driver reload cycles on RT1711H-equipped hardware
Detection Strategies
- Audit installed kernel versions against the fix commits referenced in the upstream stable tree
- Monitor dmesg and journalctl -k for probe failure sequences involving tcpci_rt1711h
- Correlate module load and unload events with subsequent Type-C subsystem errors on affected devices
Monitoring Recommendations
- Enable kernel taint and warning logging to a centralized log aggregation platform for review
- Track kernel package versions across the fleet using configuration management inventory
- Alert on kernel panics or oopses that reference USB Type-C or TCPCI symbols
How to Mitigate CVE-2026-64463
Immediate Actions Required
- Update to a Linux kernel version that includes the upstream fix commits 569f18a, 94b1abf, ce2e36e, e5406c8, or e8da46d on the applicable stable branch
- Apply vendor-provided kernel updates from your Linux distribution as soon as they are available
- Restrict local access on systems that expose RT1711H hardware until patches are deployed
Patch Information
The fix registers a devres action immediately after tcpci_register_port() succeeds, ensuring tcpci_unregister_port() executes on any subsequent probe failure or driver detach. The remove callback was removed to prevent double-unregistration. The corrected source is available in the upstream stable tree via Kernel Git Commit 569f18a, Kernel Git Commit 94b1abf, Kernel Git Commit ce2e36e, Kernel Git Commit e5406c8, and Kernel Git Commit e8da46d.
Workarounds
- Blocklist the tcpci_rt1711h module on systems that do not require USB Type-C functionality through this controller
- Limit shell access and driver reload capabilities to trusted administrators on affected hardware
- Prioritize patch deployment on mobile and embedded devices where RT1711H is commonly present
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
