{"id":"CVE-2026-98759","kind":"vulnerability","aliases":["CVE-2026-98759"],"related":[],"title":"Linux kernel: USB Type-C TPS6598x driver leaves stack data uninitialized","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()\n\ncd321x_update_work() passes a stack-allocated typec_partner_desc to\ntypec_register_partner() after initializing only usb_pd, accessory and\nidentity.\n\ntypec_register_partner() copies attach and deattach from the descriptor\ninto the partner. With those fields left unset, garbage function pointers\nmay be stored and later invoked from typec_partner_link_device() when a USB\ndevice is linked to the port. Uninitialized pd_revision and usb_capability\nsimilarly leak stack data through partner sysfs.\n\nZero-initialize the descriptor so optional callbacks remain NULL and the\nremaining fields are zero.","summary":"The Linux kernel's USB Type-C tipd (cd321x) driver registers a port partner using a stack structure whose callback and field values were never set. Stale stack contents can become function pointers invoked when a USB device attaches, which can lead to kernel memory corruption or code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","laptops","linux-kernel","usb-typec"],"not_affected_if":["driver-not-loaded","no-tipd-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release containing the upstream commit that zero-initializes typec_partner_desc in cd321x_update_work(); the sources do not name the fixed version.","status":"open","published_at":"2026-10-18T16:17:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:48+00:00","updated_at":"2026-10-25T05:16:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:16:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release containing the upstream commit that zero-initializes typec_partner_desc in cd321x_update_work(); the sources do not name the fixed version.","reach":"local","title":"Linux kernel: USB Type-C TPS6598x driver leaves stack data uninitialized","impact":"high","summary":"The Linux kernel's USB Type-C tipd (cd321x) driver registers a port partner using a stack structure whose callback and field values were never set. Stale stack contents can become function pointers invoked when a USB device attaches, which can lead to kernel memory corruption or code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","usb-typec","embedded","laptops"],"confidence":0.6,"needs_auth":"no","worst_case":"kernel memory corruption via invoked stale function pointers","analyst_note":"Check the NVD entry and the upstream kernel stable commit for the affected version range and the exact fixed releases.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-tipd-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the USB Type-C tipd/cd321x driver for a port controller that registers partners, typically laptops, embedded boards or USB-C hosts using these Apple/TI-style controllers. Machines without this hardware or driver are not affected. The sources do not say which kernel versions are vulnerable.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000622,"input_tokens":3475,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98759':15A,18A 'accessori':120C 'alloc':107C 'attach':67B,127C 'becom':59B 'c':6A,35B 'callback':48B,184C 'capabl':169C 'cd321x':37B,97C,100C 'code':76B 'content':57B 'copi':126C 'corrupt':74B 'cve':13A,16A 'data':11A,173C 'deattach':129C 'desc':95C,110C 'descriptor':132C,181C 'devic':66B,154C,158C 'driver':8A,38B 'embed':19B 'execut':77B 'field':50B,138C,190C 'fix':91C 'follow':83C 'function':60B,142C 'garbag':141C 'ident':122C 'infrastructur':20B 'initi':116C,179C 'invok':62B,149C 'kernel':2A,24B,30B,72B,81C 'laptop':21B 'later':148C 'lead':70B 'leak':171C 'leav':9A 'left':139C 'link':153C,160C 'linux':1A,23B,29B,80C 'linux-kernel':22B 'may':144C 'memori':73B 'never':53B 'null':186C 'option':183C 'partner':42B,94C,109C,114C,125C,135C,152C,175C 'pass':103C 'pd':119C,165C 'pointer':61B,143C 'port':41B,163C 'regist':39B,113C,124C 'remain':185C,189C 'resolv':87C 'revis':166C 'set':54B 'similar':170C 'stack':10A,45B,56B,106C,172C 'stack-alloc':105C 'stale':55B 'store':146C 'structur':46B 'sysf':176C 'tipd':36B,90C 'tps6598x':7A 'type':5A,34B 'type-c':4A,33B 'typec':27B,89C,93C,108C,112C,123C,151C 'uniniti':12A,92C,164C 'unset':140C 'updat':98C,101C 'usb':3A,26B,32B,65B,88C,118C,157C,168C 'usb-typec':25B 'use':43B 'valu':51B 'vulner':84C 'whose':47B 'work':99C,102C 'zero':178C,192C 'zero-initi':177C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the USB Type-C tipd/cd321x driver for a port controller that registers partners, typically laptops, embedded boards or USB-C hosts using these Apple/TI-style controllers. Machines without this hardware or driver are not affected. The sources do not say which kernel versions are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98759","severity":null,"published_at":"2026-10-18T16:17:29+00:00","modified_at":"2026-10-19T10:19:40+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}