CVE-2026-98768: Linux Kernel USB Type-C Race Condition

CVE-2026-98768 Overview

CVE-2026-98768 is a race condition in the Linux kernel's anx7411 USB Type-C driver. The vulnerability stems from improper teardown ordering during device removal. The interrupt request (IRQ) handler is managed by the devres (devm) framework, so it remains active while remove() destroys the associated workqueue. The IRQ can queue plat->work onto a workqueue that is being torn down, producing a use-after-free or kernel crash condition.

The fix disables the IRQ before destroying the workqueue, ensuring no additional work items are queued during cleanup.

Critical Impact
An active IRQ racing with workqueue destruction in the anx7411 driver can trigger kernel memory corruption or a denial of service on systems using Analogix ANX7411 USB Type-C controllers.

Affected Products

Linux kernel versions containing the drivers/usb/typec/anx7411.c driver prior to the fix
Systems using Analogix ANX7411 USB Type-C port controllers
Distributions shipping stable kernels that have not backported the referenced commits

Discovery Timeline

2026-10-18 - CVE-2026-98768 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98768

Vulnerability Analysis

The anx7411 driver registers an interrupt handler using the devres-managed API (devm_request_threaded_irq or equivalent). Devres ensures the IRQ is released automatically when the device is unbound, but it does so after the driver's own remove() function has returned.

During remove(), the driver destroys the workqueue that services plat->work. Because the IRQ is still enabled while remove() executes, an incoming interrupt can call the handler and schedule plat->work onto the workqueue just as it is being destroyed. This creates a classic teardown race.

The outcome depends on timing: the kernel may dereference freed workqueue memory, warn via destroy_workqueue() sanity checks, or crash with a NULL pointer or use-after-free. The vulnerability class is a race condition leading to a potential use-after-free in kernel context.

Root Cause

The root cause is incorrect ordering of resource cleanup. The driver relies on devres to release the IRQ after remove() completes, but remove() destroys a resource (plat->work's workqueue) that the still-active IRQ handler accesses. Devm lifetime does not align with the manual teardown of non-devm resources.

Attack Vector

Triggering the bug requires a device unbind, driver unload, or system suspend path concurrent with an interrupt from the ANX7411 controller. Interrupts in this driver are generated by USB Type-C events such as cable attach, detach, or power delivery messages. The attack vector is local and requires physical or privileged access to force driver teardown while the device is active.

The fix disables the IRQ at the start of remove() before calling destroy_workqueue(), closing the race window. Technical details are available in the upstream commit and backports for stable trees.

Detection Methods for CVE-2026-98768

Indicators of Compromise

Kernel oops or panic messages referencing anx7411, queue_work, or destroy_workqueue during module unload or device unbind
WARN_ON output from destroy_workqueue() indicating pending work items
Unexpected system crashes correlated with USB Type-C cable events on affected hardware

Detection Strategies

Audit running kernels against the fixed stable versions listed in the kernel.org commit references
Review dmesg and persistent kernel logs for stack traces involving anx7411_remove or workqueue teardown warnings
Use configuration management tooling to inventory systems that load the anx7411 module (lsmod | grep anx7411)

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized logging pipeline and alert on oops, panic, and BUG: entries
Monitor host availability for unexpected reboots on hardware fleets using Analogix ANX7411 controllers
Track kernel package versions across the fleet to confirm patch deployment status

How to Mitigate CVE-2026-98768

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix, or apply distribution-provided security updates
Identify systems running the anx7411 driver and prioritize them for patching
Avoid repeated unbind or module reload operations on affected hardware until patched

Patch Information

The fix has been merged upstream and backported to multiple stable branches. Reference commits include 469600d5d292, 50a92c02551c, 675056e0edb4, a789838675af, and cb6bf2c70780. Consult your distribution's security tracker for the specific kernel package version that incorporates the backport.

Workarounds

Blacklist the anx7411 module on systems where USB Type-C functionality from this controller is not required: echo "blacklist anx7411" > /etc/modprobe.d/anx7411.conf
Restrict administrative access to prevent unprivileged users from triggering driver unbind operations via sysfs
Avoid hot-unplugging USB Type-C devices on affected hosts until the kernel patch is applied

bash

# Verify kernel version and check for the anx7411 module
uname -r
lsmod | grep anx7411

# Blacklist the module as a temporary workaround
echo "blacklist anx7411" | sudo tee /etc/modprobe.d/anx7411.conf
sudo update-initramfs -u