{"id":"CVE-2026-98758","kind":"vulnerability","aliases":["CVE-2026-98758"],"related":[],"title":"Linux kernel: USB Type-C UCSI driver use-after-free on device removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: glink: fix use-after-free of ucsi on remove\n\nThe pmic_glink client is released by the devres cleanup, which runs\nafter pmic_glink_ucsi_remove() has returned, so its notification\ncallbacks can queue work until then. Work that runs after\nucsi_unregister() has been called touches freed state: it dereferences\nthe connector array that ucsi_unregister() freed, or registers and\nunregisters the instance a second time.\n\nDisable both work items with disable_work_sync() before unregistering,\nand unregister only if the instance is still registered.\n\nThis issue was found by an in-house static analysis tool.","summary":"In the Linux kernel's UCSI USB Type-C driver for Qualcomm pmic_glink, queued work can run after the connector state has been freed during device removal. The sources describe this as a use-after-free that can touch freed memory, and do not state a demonstrated code execution path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","qualcomm-arm","runtime","usb-typec"],"not_affected_if":["no-pmic-glink-hardware"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel build listed by your distribution's advisory.\n- Check whether the `ucsi_glink` or `pmic_glink_ucsi` driver is loaded with `lsmod | grep -i ucsi`.\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the UCSI glink use-after-free (fixed version: unknown).\n- unknown","status":"open","published_at":"2026-10-18T16:17:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:49+00:00","updated_at":"2026-10-25T05:16:49+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:16:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the UCSI glink use-after-free (fixed version: unknown).\n- unknown","reach":"local","title":"Linux kernel: USB Type-C UCSI driver use-after-free on device removal","impact":"medium","summary":"In the Linux kernel's UCSI USB Type-C driver for Qualcomm pmic_glink, queued work can run after the connector state has been freed during device removal. The sources describe this as a use-after-free that can touch freed memory, and do not state a demonstrated code execution path.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","qualcomm-arm","usb-typec"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption on device removal, possibly local privilege escalation","analyst_note":"Check the upstream kernel commit and distribution advisories for affected and fixed kernel versions and whether the bug is exploitable beyond a crash.","how_to_check":"- Run `uname -r` and compare against the fixed kernel build listed by your distribution's advisory.\n- Check whether the `ucsi_glink` or `pmic_glink_ucsi` driver is loaded with `lsmod | grep -i ucsi`.\n- unknown","needs_analyst":true,"not_affected_if":["no-pmic-glink-hardware"],"who_is_affected":"Only systems running a Linux kernel with the Qualcomm pmic_glink UCSI Type-C driver are in scope, typically Qualcomm-based ARM devices and laptops. Servers and x86 machines without this hardware driver loaded are unlikely to be affected. The sources do not say which distributions or device families ship the affected code.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000668,"input_tokens":3448,"output_tokens":646,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98758':18A,21A 'analysi':195C 'arm':27B 'array':152C 'c':6A,41B 'call':144C 'callback':130C 'cleanup':117C 'client':111C 'code':82B 'connector':53B,151C 'cve':16A,19A 'demonstr':81B 'derefer':149C 'describ':63B 'devic':14A,59B 'devr':116C 'disabl':166C,171C 'driver':8A,42B 'execut':83B 'fix':99C 'follow':90C 'found':188C 'free':12A,70B,103C 'freed':57B,74B,146C,156C 'glink':46B,98C,110C,122C 'hous':193C 'in-hous':191C 'instanc':162C,181C 'issu':186C 'item':169C 'kernel':2A,24B,35B,88C 'linux':1A,23B,34B,87C 'linux-kernel':22B 'memori':75B 'notif':129C 'path':84B 'pmic':45B,109C,121C 'qualcomm':26B,44B 'qualcomm-arm':25B 'queu':47B 'queue':132C 'regist':158C,184C 'releas':113C 'remov':15A,60B,107C,124C 'resolv':94C 'return':126C 'run':50B,119C,138C 'runtim':28B 'second':164C 'sourc':62B 'state':54B,79B,147C 'static':194C 'still':183C 'sync':173C 'time':165C 'tool':196C 'touch':73B,145C 'type':5A,40B 'type-c':4A,39B 'typec':31B,96C 'ucsi':7A,37B,97C,105C,123C,140C,154C 'unregist':141C,155C,160C,175C,177C 'usb':3A,30B,38B,95C 'usb-typec':29B 'use':10A,68B,101C 'use-after-fre':9A,67B,100C 'vulner':91C 'work':48B,133C,136C,168C,172C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the Qualcomm pmic_glink UCSI Type-C driver are in scope, typically Qualcomm-based ARM devices and laptops. Servers and x86 machines without this hardware driver loaded are unlikely to be affected. The sources do not say which distributions or device families ship the affected code.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98758","severity":null,"published_at":"2026-10-18T16:17:29+00:00","modified_at":"2026-10-19T10:19:39+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}