CVE-2026-98760: Linux Kernel USB Type-C Information Disclosure

CVE-2026-98760 Overview

CVE-2026-98760 is an uninitialized memory use vulnerability in the Linux kernel's USB Type-C Power Delivery driver (tipd) for Texas Instruments TPS6598x controllers. The function tps6598x_connect() passes a stack-allocated typec_partner_desc structure to typec_register_partner() after initializing only the usb_pd, accessory, and identity fields. The uninitialized attach and deattach callback pointers can later be invoked, while pd_revision and usb_capability leak stack data through sysfs. The fix zero-initializes the descriptor so optional callbacks remain NULL.

Critical Impact
Garbage function pointers from the kernel stack may be invoked when a USB device is linked to the Type-C port, enabling potential kernel code execution or information disclosure via partner sysfs attributes.

Affected Products

Linux kernel drivers/usb/typec/tipd/core.c (TPS6598x Type-C PD driver)
Linux kernel branches containing the vulnerable tps6598x_connect() implementation
Systems using Texas Instruments TPS6598x USB Type-C controllers

Discovery Timeline

2026-10-18 - CVE-2026-98760 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98760

Vulnerability Analysis

The defect resides in the tps6598x_connect() function within the tipd driver. The function declares a typec_partner_desc structure on the stack and populates only three fields: usb_pd, accessory, and identity. It then passes the partially initialized descriptor to typec_register_partner().

The partner registration routine copies the attach and deattach callback pointers from the descriptor into the new partner object. Because these fields were never initialized, they retain stack residue. When a USB device is subsequently linked to the Type-C port, typec_partner_link_device() dereferences and calls these function pointers, transferring control to an attacker-influenceable kernel address.

The pd_revision and usb_capability fields are similarly uninitialized. These values become readable through partner sysfs attributes, leaking raw stack contents to user space.

Root Cause

The root cause is uninitialized memory use. The stack-allocated typec_partner_desc structure was not zeroed before selective field assignment. C does not implicitly zero stack variables, so unassigned fields contain whatever data previously occupied that stack region. The fix zero-initializes the descriptor so optional callbacks remain NULL and remaining fields are deterministic.

Attack Vector

Exploitation requires a USB Type-C connect event on a system using the TPS6598x PD controller. An attacker with physical access who plugs in a USB device triggers the connect path, which eventually invokes the uninitialized attach callback. Stack layout at the moment of tps6598x_connect() execution determines the garbage pointer value. The sysfs information disclosure is reachable by any local user that can read Type-C partner sysfs attributes.

No verified public exploit code is available. The vulnerability is described in prose per the kernel commit messages referenced below. See Linux Kernel Commit 4b6823c and Linux Kernel Commit dac0c07 for the authoritative fix descriptions.

Detection Methods for CVE-2026-98760

Indicators of Compromise

Kernel oops or panic traces referencing typec_partner_link_device or tps6598x_connect with invalid instruction pointers.
Unexpected call targets in kernel stack traces originating from the tipd driver on USB Type-C hotplug events.
Anomalous content in /sys/class/typec/port*-partner/ attributes such as pd_revision or usb_capability.

Detection Strategies

Audit running kernel versions against the fixed commits listed in NVD references to identify unpatched hosts.
Monitor kernel ring buffer (dmesg) for crashes or warnings tied to USB Type-C partner registration.
Enable KASAN and CONFIG_INIT_STACK_ALL_ZERO in test builds to surface uninitialized read conditions during fuzzing.

Monitoring Recommendations

Collect kernel crash telemetry centrally and alert on faults within the drivers/usb/typec/tipd code path.
Track physical USB Type-C connect events on sensitive endpoints such as laptops and embedded devices.
Correlate kernel version inventory with the patch commits referenced in Linux Kernel Commit 282be6a to prioritize remediation.

How to Mitigate CVE-2026-98760

Immediate Actions Required

Update affected systems to a Linux kernel release that includes the upstream fix for tps6598x_connect().
On systems that cannot be patched immediately, restrict physical access to USB Type-C ports on devices using TPS6598x controllers.
Audit custom or vendor kernels that backport the tipd driver to confirm the zero-initialization change is present.

Patch Information

The fix zero-initializes the typec_partner_desc structure in tps6598x_connect() so uninitialized callback pointers remain NULL and all other fields default to zero. The upstream and stable fixes are available at Linux Kernel Commit 4b6823c, Linux Kernel Commit 282be6a, Linux Kernel Commit a39d53f, Linux Kernel Commit c4b27b3, and Linux Kernel Commit dac0c07.

Workarounds

Unload or blacklist the tps6598x kernel module on systems that do not require Type-C PD functionality.
Disable or physically block USB Type-C ports on high-value hosts until a patched kernel is deployed.
Enable kernel hardening options such as CONFIG_INIT_STACK_ALL_ZERO where available to reduce the impact of uninitialized stack reads.

bash

# Verify whether the tps6598x driver is loaded
lsmod | grep tps6598x

# Temporarily unload the module (requires root)
sudo modprobe -r tps6598x

# Blacklist the module across reboots
echo 'blacklist tps6598x' | sudo tee /etc/modprobe.d/blacklist-tps6598x.conf