CVE-2026-68372: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68372 Overview

CVE-2026-68372 is a use-after-free vulnerability in the Linux kernel USB core subsystem. The flaw resides in connector_unbind() within drivers/usb/core/port.c, which fails to call typec_deattach() symmetrically with its connector_bind() counterpart. When a Thunderbolt dock is unplugged, two teardown paths race, leaving port->usb2_dev and port->usb3_dev pointing at freed USB device memory. Subsequent USB Type-C Connector System Software Interface (UCSI) events dereference these dangling pointers through sysfs_remove_link() and dev_name(), corrupting typec/UCSI partner state.

Critical Impact
Concurrent teardown paths dereference freed memory during Thunderbolt dock hot-unplug, corrupting kernel state and potentially triggering use-after-free conditions in the Type-C subsystem.

Affected Products

Linux kernel USB core subsystem (drivers/usb/core/port.c)
Systems using Thunderbolt docks with Type-C connectors
Hardware relying on UCSI for Power Delivery partner management

Discovery Timeline

2026-08-10 - CVE CVE-2026-68372 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68372

Vulnerability Analysis

The vulnerability arises from asymmetric teardown logic in the USB Type-C connector binding lifecycle. The connector_bind() function calls typec_attach(port_dev->connector, &port_dev->child->dev) when port_dev->child exists. However, connector_unbind() clears port_dev->connector = NULL without invoking the mirror typec_deattach() call.

When a Thunderbolt dock is unplugged, the component framework calls connector_unbind() first. This leaves port->usb2_dev and port->usb3_dev in struct typec_port pointing at the USB device that is about to be freed. Subsequently, usb_disconnect() invokes typec_deattach(port_dev->connector, ...), but the connector pointer is already NULL, making the call a no-op.

Concurrently, UCSI detects a Power Delivery partner-disconnect event and calls typec_unregister_partner(). This function reads the dangling port->usb2_dev pointer and passes it through typec_partner_unlink_device() to sysfs_remove_link() and dev_name(), dereferencing freed memory.

Root Cause

The root cause is a missing symmetric cleanup call in connector_unbind(). The bind path attaches the Type-C connector to its USB child device but the unbind path never detaches it. This asymmetry allows stale device pointers to persist in the typec_port structure after backing memory is freed.

Attack Vector

Exploitation requires physical access to trigger Thunderbolt dock hot-unplug events. The race condition between the component framework teardown and UCSI partner-disconnect handling produces observable failures. On affected hardware, the dock's I225/igc network interface fails to enumerate on subsequent hot-plug, AER fires slot resets during driver initialization, and kernel warnings appear in kernfs_remove_by_name_ns(). With adverse timing, the stale pointer is dereferenced after backing memory is freed, converting a warning into a use-after-free condition.

No synthetic exploit code is provided. See the upstream kernel commits referenced below for the authoritative patch analysis.

Detection Methods for CVE-2026-68372

Indicators of Compromise

Kernel warnings from kernfs_remove_by_name_ns+0xe9/0xf0 with the message kernfs: can not remove 'typec', no directory
AER slot reset events accompanied by PCIe link lost, device now detached for igc or similar NICs behind Thunderbolt docks
Warnings in igc_rd32 at drivers/net/ethernet/intel/igc/igc_main.c:7005 during dock reconnection
Call traces including typec_unregister_partner invoked from ucsi_handle_connector_change

Detection Strategies

Monitor dmesg and journald for the specific WARN traces originating in sysfs_remove_link under the typec_ucsi workqueue path
Correlate Thunderbolt hot-plug events with PCIe AER errors on downstream devices
Track kernel version deployment to identify systems missing the referenced stable commits

Monitoring Recommendations

Ingest kernel logs into a centralized telemetry pipeline and alert on WARNING: CPU: traces referencing typec or ucsi symbols
Baseline expected USB and Type-C subsystem messages across your fleet to surface anomalous unbind sequences
Track Thunderbolt dock reconnect failures as a proxy signal for the underlying corruption

How to Mitigate CVE-2026-68372

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits 7714fb8, 78d361e, e00109b, and e0b291f
Update to a Linux distribution kernel that incorporates the fix in drivers/usb/core/port.c
Inventory endpoints using Thunderbolt docks and prioritize them for patching

Patch Information

The fix calls typec_deattach() before clearing port_dev->connector, matching the symmetry of connector_bind(). Because typec_partner_deattach() is protected by port->partner_link_lock, it serializes safely with the concurrent typec_unregister_partner() path. See Kernel Git Commit 7714fb8, Kernel Git Commit 78d361e, Kernel Git Commit e00109b, and Kernel Git Commit e0b291f.

Workarounds

Avoid frequent hot-unplug of Thunderbolt docks on unpatched systems
Where feasible, disable UCSI or unload typec_ucsi on affected hosts until the kernel is patched
Restrict physical access to Thunderbolt ports on shared or unattended systems

bash

# Verify kernel version and check for the fix
uname -r
git log --oneline drivers/usb/core/port.c | grep -E '7714fb8|78d361e|e00109b|e0b291f'