CVE-2026-90026: Linux Kernel USB Type-C Use-After-Free

CVE-2026-90026 Overview

CVE-2026-90026 is a use-after-free vulnerability in the Linux kernel's USB Type-C Qualcomm PMIC (Power Management Integrated Circuit) driver. The flaw resides in the pdphy_stop() function, which disables interrupt requests (IRQs) but fails to cancel a pending reset_work item. If the IRQ handler schedules the work just before disable_irq() executes, the work can run after remove() has freed the associated device-managed (devm) structure. The issue was identified by an in-house static analysis tool and has been resolved upstream.

Critical Impact
A local attacker with the ability to trigger device removal or driver unload can leverage the race condition to execute code in kernel context, escalate privileges, or crash the system.

Affected Products

Linux kernel USB Type-C subsystem
Qualcomm PMIC PD PHY driver (qcom-pmic)
Distributions shipping Linux kernels prior to the fixed stable releases

Discovery Timeline

2026-09-16 - CVE-2026-90026 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90026

Vulnerability Analysis

The vulnerability is a classic race condition leading to a use-after-free condition in a kernel driver. The pdphy_stop() routine in the Qualcomm PMIC USB Type-C driver disables the device IRQ line but does not synchronize pending work items scheduled from the IRQ handler. Kernel workqueues run asynchronously, so a reset_work item queued shortly before disable_irq() remains scheduled after the driver stops.

When the driver's remove() path completes, the devm-allocated structures backing the driver are freed. If the pending reset_work executes after this teardown, it operates on freed memory. Kernel use-after-free conditions in driver contexts are commonly exploitable for privilege escalation or arbitrary kernel memory corruption. The upstream fix adds a cancel_work_sync() call after IRQ disablement to close the window.

Root Cause

The root cause is missing work-item synchronization during driver teardown. pdphy_stop() assumed that disabling IRQs was sufficient to prevent further activity, but did not account for work already scheduled by the IRQ handler. The devm allocator releases resources when the device unbinds, creating a dangling reference for any late-running work.

Attack Vector

Exploitation requires local access with the ability to trigger a driver unload, device hot-remove, or module removal on a system using the Qualcomm PMIC USB Type-C driver. An attacker with sufficient privileges to induce the race — for example, by rapidly toggling device state or unloading the module while USB Type-C events occur — can drive the kernel into the use-after-free window. Because the freed structure is controlled by device-managed allocation, the attacker may groom the slab to place attacker-controlled data at the freed address, enabling kernel memory corruption.

No public proof-of-concept exploit is available for CVE-2026-90026. See the upstream commits referenced in the Kernel Git Commit 0b69b16 and Kernel Git Commit d4e00a1 references for the fix details.

Detection Methods for CVE-2026-90026

Indicators of Compromise

Kernel oops or panic logs referencing pdphy, reset_work, or qcom-pmic-typec after device removal or module unload events.
KASAN (Kernel Address Sanitizer) reports indicating use-after-free in the USB Type-C Qualcomm PMIC driver code path.
Unexpected reboots or kernel crashes on Qualcomm-based platforms during USB Type-C connector state transitions.

Detection Strategies

Enable KASAN on test systems to identify the use-after-free at runtime during driver unbind operations.
Monitor dmesg for warnings from workqueue subsystems referencing freed objects or scheduled work after device release.
Audit installed kernel versions against the fixed stable releases identified in the upstream commits.

Monitoring Recommendations

Collect and centralize kernel logs from Linux endpoints to identify crash patterns tied to USB subsystem activity.
Alert on repeated module unload or device unbind events for qcom-pmic-typec on production systems.
Track kernel package versions across the fleet and flag hosts running vulnerable builds.

How to Mitigate CVE-2026-90026

Immediate Actions Required

Apply the upstream kernel patches referenced in the CVE record to all affected Linux systems.
Prioritize patching on Qualcomm-based hardware and mobile or embedded devices using the qcom-pmic USB Type-C driver.
Restrict local access and limit which users can load, unload, or unbind kernel modules on multi-user systems.

Patch Information

The fix adds a cancel_work_sync() call after disabling IRQs in pdphy_stop(), ensuring that any pending reset_work completes before device-managed memory is freed. Fixes are available in the following upstream commits: Kernel Git Commit 0b69b16, Kernel Git Commit 52d556f, Kernel Git Commit 7b0df6e, Kernel Git Commit b9a7eed, and Kernel Git Commit d4e00a1. Consume the fix by updating to a stable kernel release incorporating these commits.

Workarounds

Blacklist the qcom-pmic-typec module on systems that do not require USB Type-C Power Delivery functionality.
Prevent unprivileged users from initiating driver unbind operations through sysfs permissions hardening.
Restrict CAP_SYS_MODULE and CAP_SYS_ADMIN capabilities to trusted administrative accounts only.

bash

# Configuration example: blacklist the vulnerable module until patched
echo "blacklist qcom_pmic_typec" | sudo tee /etc/modprobe.d/blacklist-qcom-pmic-typec.conf
sudo update-initramfs -u