CVE-2026-90028 Overview
CVE-2026-90028 affects the Linux kernel's hd3ss3220 USB Type-C controller driver. The driver incorrectly relies on regulator_is_enabled() to determine whether it holds an enable reference on the VBUS regulator. That function returns the aggregate regulator state across all consumers, not per-consumer reference counts. When another consumer enables VBUS first, the hd3ss3220 driver skips its own regulator_enable() call and later attempts to drop a reference it never acquired. The result is an unbalanced regulator disable warning and inconsistent VBUS power state on affected USB Type-C hardware.
Critical Impact
Incorrect VBUS reference tracking in the hd3ss3220 driver can trigger unbalanced regulator disable warnings and destabilize USB Type-C power delivery on systems using this controller.
Affected Products
- Linux kernel usb: typec: hd3ss3220 driver
- Systems using the TI HD3SS3220 USB Type-C port controller
- Distributions shipping affected upstream kernel versions prior to the fix
Discovery Timeline
- 2026-09-16 - CVE-2026-90028 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90028
Vulnerability Analysis
The hd3ss3220 driver manages VBUS power for USB Type-C role switching on the Texas Instruments HD3SS3220 controller. To decide whether to enable or disable VBUS, the driver queried regulator_is_enabled(). That API reports whether the underlying regulator is currently on, aggregated across every consumer, rather than tracking whether this specific driver holds an enable reference.
When a second consumer had already enabled the shared VBUS regulator, hd3ss3220 observed the regulator as enabled and skipped its own regulator_enable() call. On a later role change or ID notification, the driver called regulator_disable() even though it had never incremented the reference count. The regulator core detected the imbalance and emitted an unbalanced disable warning, and the actual VBUS state diverged from what the driver expected.
The fix tracks successful enable and disable operations locally in the driver state. The local state is preserved when an operation fails, so subsequent role or ID notifications retry the operation and this consumer maintains balanced references.
Root Cause
The root cause is a logic error in state tracking. The driver used a global regulator query as a proxy for its own per-consumer state. The two are not equivalent when multiple consumers share the same regulator supply.
Attack Vector
This is a kernel logic defect triggered through normal USB Type-C role switching and ID pin notifications. There is no documented remote exploitation path. Impact is limited to kernel warnings and inconsistent VBUS power management on hardware that combines the hd3ss3220 driver with a shared VBUS regulator.
No verified proof-of-concept code is available. Refer to the upstream kernel commits c9a48db776d7 and df7cd3908e07 for the corrected reference tracking logic.
Detection Methods for CVE-2026-90028
Indicators of Compromise
- Kernel log messages from the regulator core reporting an unbalanced disable on the VBUS supply used by hd3ss3220.
- USB Type-C role switch or ID pin transitions that leave VBUS in an unexpected state on affected hardware.
Detection Strategies
- Identify systems running kernels that include the hd3ss3220 driver without the reference-tracking fix from commits c9a48db776d7 or df7cd3908e07.
- Correlate dmesg output for unbalanced disables warnings tied to the VBUS regulator when USB Type-C events occur.
Monitoring Recommendations
- Collect kernel ring buffer logs from embedded and edge devices using the HD3SS3220 controller and alert on regulator imbalance warnings.
- Track kernel package versions across the fleet to confirm patched builds are deployed on hardware exposing USB Type-C role switching.
How to Mitigate CVE-2026-90028
Immediate Actions Required
- Update affected systems to a Linux kernel build that includes the upstream fixes referenced in commits c9a48db776d7 and df7cd3908e07.
- Inventory devices that load the hd3ss3220 driver and prioritize them for kernel updates through your distribution's stable channel.
Patch Information
The fix modifies the hd3ss3220 driver to track VBUS enable and disable operations per consumer instead of relying on regulator_is_enabled(). Local state is only updated when the underlying regulator call succeeds, ensuring that references remain balanced across retries. Apply the stable kernel update from your distribution vendor once it incorporates these commits.
Workarounds
- No supported workaround exists at the driver level; unloading the hd3ss3220 module disables USB Type-C role switching on affected hardware and is not recommended for production.
- Where feasible, avoid sharing the VBUS regulator between multiple consumers until the patched kernel is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
