CVE-2026-98761: Linux Kernel USB Type-C TCPM Vulnerability

CVE-2026-98761 Overview

CVE-2026-98761 is a Linux kernel vulnerability in the USB Type-C Port Manager (TCPM) subsystem. The flaw affects handling of the Fast Role Swap (FRS) Atomic Message Sequence (AMS) during cable disconnection events. When the TCPM fails to start the FAST_ROLE_SWAP AMS, it transitions to INVALID_STATE without resetting the port, leaving VBUS sourcing enabled. Some cables incorrectly signal FRS during disconnection, triggering the Type-C Port Controller (TCPC) to autonomously source VBUS. Without proper recovery, the port remains in an inconsistent state with power delivery active after disconnect. The fix initiates error recovery to reset the port when the FRS AMS fails to start.

Critical Impact
Improper state handling leaves USB Type-C ports sourcing VBUS power after cable disconnect, creating an inconsistent hardware state that persists until manual recovery.

Affected Products

Linux kernel USB Type-C Port Manager (TCPM) driver
Systems using USB Power Delivery with Fast Role Swap-capable ports
Platforms using TCPC hardware that autonomously sources VBUS on FRS signal detection

Discovery Timeline

2026-10-18 - CVE CVE-2026-98761 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98761

Vulnerability Analysis

The vulnerability resides in the tcpm driver that implements the USB Type-C Port Manager state machine. When a Fast Role Swap signal arrives, the TCPC hardware autonomously begins sourcing VBUS before the software state machine processes the event. The TCPM then attempts to initiate the FAST_ROLE_SWAP AMS by requesting Sink TX.

If the cable is already disconnecting, both Configuration Channel (CC) lines read as open. This causes tcpm_sink_tx_ok to evaluate to 0, producing a Sink TX No Go result. The AMS fails to start, and the TCPM transitions the state to INVALID_STATE without clearing the autonomous VBUS sourcing initiated by the TCPC.

The log evidence shows the port remains in a VBUS-on condition after disconnect, with no further state transitions to disable power delivery. This represents a classification of improper error handling and state management [CWE-755] within kernel power delivery logic.

Root Cause

The root cause is missing error recovery in the TCPM state machine when the FRS AMS fails to initialize. Setting state to INVALID_STATE bypasses the normal port reset path that would terminate autonomous VBUS sourcing by the TCPC.

Attack Vector

The condition is triggered by physical cable disconnection events on FRS-capable ports, particularly with cables that incorrectly signal FRS during unplug. The flaw is not remotely exploitable and requires local hardware interaction. The patch introduces an explicit ERROR_RECOVERY transition followed by a PORT_RESET sequence that disables VBUS discharge, clears role state, and returns the port to SNK_UNATTACHED.

See the upstream fix commits for implementation details, including kernel commit ae8aae4 and kernel commit d6b0cce.

Detection Methods for CVE-2026-98761

Indicators of Compromise

Kernel log entries showing AMS FAST_ROLE_SWAP start immediately followed by Sink TX No Go without a subsequent state change to ERROR_RECOVERY
Persistent VBUS on messages in dmesg after a USB Type-C disconnect event
TCPM state stuck at SNK_READY after CC lines report disconnection (e.g., CC1: 0 -> 0, CC2: 5 -> 0)

Detection Strategies

Monitor kernel ring buffer output from drivers/usb/typec/tcpm/tcpm.c for the Sink TX No Go pattern during FRS attempts
Compare running kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts at scale
Audit USB Power Delivery hardware fleets for FRS-capable TCPC implementations that may exhibit this behavior

Monitoring Recommendations

Forward dmesg and journald output to a centralized log aggregation platform and alert on repeated VBUS on events without matching VBUS off transitions
Track kernel package versions across endpoints to maintain visibility into TCPM subsystem patch status
Correlate hardware event logs with user-reported USB connectivity issues on affected systems

How to Mitigate CVE-2026-98761

Immediate Actions Required

Update Linux kernel packages to a version that includes the TCPM FRS recovery fix referenced in the upstream commits
Prioritize patching on platforms known to use FRS-capable USB Type-C controllers, including mobile devices and docking station hosts
Verify kernel update deployment by inspecting the tcpm.c module version and testing FRS behavior where feasible

Patch Information

The upstream fix adds an explicit error recovery path. When tcpm_ams_start fails for the FAST_ROLE_SWAP AMS, the driver now transitions to ERROR_RECOVERY, which triggers PORT_RESET and PORT_RESET_WAIT_OFF states to properly disable VBUS sourcing. The fix is distributed across multiple stable branches via commits 184d842, 9015658, ae8aae4, b2ed864, and d6b0cce.

Workarounds

Avoid using USB Type-C cables that incorrectly signal FRS during disconnection on FRS-capable ports
Where kernel updates cannot be applied immediately, unload the tcpm module on systems that do not require USB Power Delivery functionality
Physically re-seat affected cables or power-cycle the host to clear stuck VBUS sourcing after disconnect events

bash

# Verify kernel version and check TCPM module status
uname -r
lsmod | grep tcpm
# Review recent TCPM state transitions and VBUS events
dmesg | grep -E 'tcpm|VBUS|FAST_ROLE_SWAP'