CVE-2026-90027: Linux Kernel QCOM PMIC Type-C UAF Vulnerability

CVE-2026-90027 Overview

CVE-2026-90027 is a use-after-free vulnerability in the Linux kernel's Qualcomm PMIC USB Type-C driver (qcom-pmic-typec). The flaw exists in the port_stop() teardown path, where cc_debounce_dwork can be requeued by TCPM callbacks running on a separate kthread worker after port_stop() has already returned. When the delayed work eventually executes, devres may have already freed the backing pmic_typec_port structure, leading to memory corruption. The issue was identified by an in-house static analysis tool and resolved by using disable_delayed_work_sync() in port_stop() to cancel pending instances and prevent further queueing.

Critical Impact
A local attacker with the ability to trigger USB Type-C port teardown can exploit the race condition to corrupt kernel memory, potentially resulting in privilege escalation or denial of service on affected Qualcomm-based systems.

Affected Products

Linux kernel branches containing the drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c driver
Qualcomm PMIC-based platforms using the Type-C Port Manager (TCPM)
Downstream distributions shipping vulnerable stable kernels prior to the fix commits

Discovery Timeline

2026-09-16 - CVE-2026-90027 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90027

Vulnerability Analysis

The vulnerability resides in the Qualcomm PMIC Type-C port driver, which participates in USB power delivery and CC line management. The cc_debounce_dwork delayed work item is queued from the set_cc() and start_toggling() callbacks. These callbacks execute in the context of the Type-C Port Manager's (TCPM) dedicated kthread worker.

During driver teardown, port_stop() returns before tcpm_unregister_port() destroys the TCPM kthread worker. Flushing the worker during unregistration can therefore invoke a TCPM callback that queues the delayed work after port_stop() has already completed. The delayed work then runs against a pmic_typec_port structure that devres has already released.

The resulting use-after-free operates on kernel memory freed through the device-managed resource framework. An attacker who can influence USB Type-C event timing during unbind or unload sequences may steer the race to overlap with an allocation that reuses the freed slab object.

Root Cause

The root cause is a teardown ordering flaw combined with insufficient synchronization of delayed work. port_stop() did not cancel or disable pending cc_debounce_dwork items, nor did it prevent TCPM callbacks from queueing new ones during the teardown window. The devres cleanup then freed the driver's port data while a scheduled callback remained live in the workqueue.

Attack Vector

Exploitation requires local access with the privileges necessary to trigger device unbind, module unload, or a USB Type-C teardown event. The attacker must win a narrow race between TCPM worker callbacks and devres cleanup. Successful exploitation leads to a use-after-free on kernel memory, with potential for information disclosure, kernel panic, or code execution depending on heap layout and reuse.

The upstream fix replaces the missing cancellation with disable_delayed_work_sync() in port_stop(). This both cancels any pending instance and blocks TCPM callbacks from queueing another one before teardown completes. See the fix commits 1ab669c, 263f7d6, 4359b5f, and c614d7c for the applied stable-tree patches.

Detection Methods for CVE-2026-90027

Indicators of Compromise

Unexpected kernel oops or panic traces referencing cc_debounce_dwork, pmic_typec_port, or tcpm_unregister_port in dmesg and journalctl -k output
KASAN use-after-free reports naming the qcom_pmic_typec driver on kernels built with CONFIG_KASAN=y
Sporadic USB Type-C subsystem failures correlated with driver unbind, module unload, or suspend/resume cycles

Detection Strategies

Enumerate running kernel versions across Qualcomm-based Linux fleets and flag hosts not yet carrying the fix commits listed above.
Enable KASAN and workqueue debugging (CONFIG_DEBUG_WORKQUEUE) in test images to surface pending delayed work at driver teardown.
Alert on kernel ring-buffer messages containing use-after-free, BUG:, or WARNING: strings paired with Type-C driver symbols.

Monitoring Recommendations

Forward kernel logs from Qualcomm-based endpoints and embedded devices to a central log store for correlation across reboots.
Track module load and unload events for qcom_pmic_typec and related TCPM modules to identify unusual teardown activity.
Monitor privileged local sessions that repeatedly bind, unbind, or rebind USB Type-C devices, as this pattern is required to reach the vulnerable code path.

How to Mitigate CVE-2026-90027

Immediate Actions Required

Apply the upstream stable kernel updates that include the disable_delayed_work_sync() fix for qcom-pmic-typec.
Prioritize patching on Qualcomm-based laptops, developer boards, and embedded systems that expose USB Type-C ports.
Restrict local shell and module-management privileges to trusted administrators until patched kernels are deployed.

Patch Information

The issue is resolved in the Linux stable trees by commits 1ab669c, 263f7d6, 4359b5f, and c614d7c. Update to a kernel release that incorporates one of these commits and rebuild any out-of-tree modules that depend on the TCPM interfaces.

Workarounds

Where patching is delayed, avoid unbinding or unloading the qcom_pmic_typec driver on production systems.
Limit access to sysfs bind/unbind entries under /sys/bus/platform/drivers/ for the Type-C driver to root-only.
Blacklist the module on systems that do not require USB Type-C functionality until an updated kernel is available.

bash

# Example: verify the running kernel and restrict driver bind/unbind access
uname -r
dmesg | grep -iE 'qcom_pmic_typec|tcpm|cc_debounce'
chmod 600 /sys/bus/platform/drivers/qcom_pmic_typec/bind \
           /sys/bus/platform/drivers/qcom_pmic_typec/unbind