GHSA-5RW9-RVHW-F33H
Vulnerability from github – Published: 2026-08-15 15:30 – Updated: 2026-08-23 15:33In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: Fix race condition and ordering in port unregistration
A synchronization issue exists during port unregistration where pending partner work items can race against workqueue destruction, leading to use-after-free conditions:
cros_ec_ucsi cros_ec_ucsi.3.auto: error -ETIMEDOUT: PPM init failed BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:__queue_work+0x83/0x4a0 Call Trace: __cfi_delayed_work_timer_fn+0x10/0x10 run_timer_softirq+0x3b6/0xbd0 sched_clock_cpu+0xc/0x110 irq_exit_rcu+0x18d/0x330 fred_sysvec_apic_timer_interrupt+0x5e/0x80
Fix this by ensuring strict ordering and proper serialization during teardown:
- Move ucsi_unregister_partner() to the beginning of the teardown sequence and protect it under the connector mutex lock.
- Ensure all pending partner tasks are explicitly flushed and finished before the workqueue is destroyed.
- Switch from mod_delayed_work() to a cancel_delayed_work() and queue_delayed_work() sequence. This guarantees that items currently marked as pending won't be scheduled an additional time, preventing a double release of resources which leads to the following crash:
Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP NOPTI Workqueue: cros_ec_ucsi.3.auto-con2 ucsi_poll_worker RIP: 0010:ucsi_poll_worker+0x65/0x1e0 Call Trace: process_scheduled_works+0x218/0x6d0 worker_thread+0x188/0x3f0 __cfi_worker_thread+0x10/0x10 kthread+0x226/0x2a0
To ensure these rules are applied identically across both the normal teardown and the ucsi_init() error paths, consolidate the cleanup logic into a new helper, ucsi_unregister_port().
{
"affected": [],
"aliases": [
"CVE-2026-74441"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-15T13:17:48Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Fix race condition and ordering in port unregistration\n\nA synchronization issue exists during port unregistration where pending\npartner work items can race against workqueue destruction, leading to\nuse-after-free conditions:\n\n cros_ec_ucsi cros_ec_ucsi.3.auto: error -ETIMEDOUT: PPM init failed\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n RIP: 0010:__queue_work+0x83/0x4a0\n Call Trace:\n \u003cIRQ\u003e\n __cfi_delayed_work_timer_fn+0x10/0x10\n run_timer_softirq+0x3b6/0xbd0\n sched_clock_cpu+0xc/0x110\n irq_exit_rcu+0x18d/0x330\n fred_sysvec_apic_timer_interrupt+0x5e/0x80\n\nFix this by ensuring strict ordering and proper serialization during\nteardown:\n\n1. Move ucsi_unregister_partner() to the beginning of the teardown\nsequence and protect it under the connector mutex lock.\n2. Ensure all pending partner tasks are explicitly flushed and finished\nbefore the workqueue is destroyed.\n3. Switch from mod_delayed_work() to a cancel_delayed_work() and\nqueue_delayed_work() sequence. This guarantees that items currently marked\nas pending won\u0027t be scheduled an additional time, preventing a double\nrelease of resources which leads to the following crash:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdead000000000122: 0000 [#1] SMP NOPTI\n Workqueue: cros_ec_ucsi.3.auto-con2 ucsi_poll_worker\n RIP: 0010:ucsi_poll_worker+0x65/0x1e0\n Call Trace:\n \u003cTASK\u003e\n process_scheduled_works+0x218/0x6d0\n worker_thread+0x188/0x3f0\n __cfi_worker_thread+0x10/0x10\n kthread+0x226/0x2a0\n\nTo ensure these rules are applied identically across both the normal\nteardown and the ucsi_init() error paths, consolidate the cleanup logic\ninto a new helper, ucsi_unregister_port().",
"id": "GHSA-5rw9-rvhw-f33h",
"modified": "2026-08-23T15:33:01Z",
"published": "2026-08-15T15:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74441"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/07f8aaffee705e552c1f723ac8bf7eb137ad59c2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/11483d80267db97fbe49f2df66385434256cc3b0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3f7b3728dd9011c915cbeaea77274ebe8366550d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7aa7d4bf9d3fa9a6a47b640ad103ab433b7ff261"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7b63c680ff605f60f056e5f2c323f1a602aee182"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bc7a0f721123ea260a42f1ded06dab844ba49434"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.