{"id":"CVE-2026-98760","kind":"vulnerability","aliases":["CVE-2026-98760"],"related":[],"title":"Linux kernel: USB Type-C TPS6598x driver leaves stack garbage in partner registration","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()\n\ntps6598x_connect() passes a stack-allocated typec_partner_desc to\ntypec_register_partner() after initializing only usb_pd, accessory and\nidentity.\n\ntypec_register_partner() copies attach and deattach from the descriptor\ninto the partner. With those fields left unset, garbage function pointers\nmay be stored and later invoked from typec_partner_link_device() when a USB\ndevice is linked to the port. Uninitialized pd_revision and usb_capability\nsimilarly leak stack data through partner sysfs.\n\nZero-initialize the descriptor so optional callbacks remain NULL and the\nremaining fields are zero.","summary":"The Linux kernel's TPS6598x USB Type-C port driver registers a partner descriptor from uninitialized stack memory, so callback pointers and fields can hold garbage. The bad function pointers can be invoked when a USB device is linked to the port, and sysfs exposes leaked stack data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","linux-kernel","runtime","usb-typec"],"not_affected_if":["no-tps6598x-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix zeroing the typec_partner_desc in tps6598x_connect() (version unknown from sources)\n- unknown","status":"open","published_at":"2026-10-18T16:17:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:47+00:00","updated_at":"2026-10-25T05:16:47+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:16:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix zeroing the typec_partner_desc in tps6598x_connect() (version unknown from sources)\n- unknown","reach":"local","title":"Linux kernel: USB Type-C TPS6598x driver leaves stack garbage in partner registration","impact":"medium","summary":"The Linux kernel's TPS6598x USB Type-C port driver registers a partner descriptor from uninitialized stack memory, so callback pointers and fields can hold garbage. The bad function pointers can be invoked when a USB device is linked to the port, and sysfs exposes leaked stack data.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","usb-typec","embedded"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Kernel code runs garbage function pointers; stack data leaks via sysfs","analyst_note":"Confirm affected kernel version range and the fixing commit from the NVD entry or kernel.org stable mailing list; the sources do not give a version or CVSS.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-tps6598x-hardware"],"who_is_affected":"Systems running a Linux kernel with the TI TPS6598x USB Type-C port controller driver (usb: typec: tipd), typically laptops or boards using that controller. Systems without this hardware or driver are not affected. The sources do not say which kernel versions are vulnerable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3475,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98760':17A,20A 'accessori':118C 'alloc':105C 'attach':125C 'bad':57B 'c':6A,37B 'callback':49B,182C 'capabl':167C 'connect':98C,100C 'copi':124C 'cve':15A,18A 'data':77B,171C 'deattach':127C 'desc':95C,108C 'descriptor':43B,130C,179C 'devic':66B,152C,156C 'driver':8A,39B 'embed':21B 'expos':74B 'field':52B,136C,188C 'fix':91C 'follow':83C 'function':58B,140C 'garbag':11A,55B,139C 'hold':54B 'ident':120C 'initi':114C,177C 'invok':62B,147C 'kernel':2A,24B,31B,81C 'later':146C 'leak':75B,169C 'leav':9A 'left':137C 'link':68B,151C,158C 'linux':1A,23B,30B,80C 'linux-kernel':22B 'may':142C 'memori':47B 'null':184C 'option':181C 'partner':13A,42B,94C,107C,112C,123C,133C,150C,173C 'pass':101C 'pd':117C,163C 'pointer':50B,59B,141C 'port':38B,71B,161C 'regist':40B,111C,122C 'registr':14A 'remain':183C,187C 'resolv':87C 'revis':164C 'runtim':25B 'similar':168C 'stack':10A,46B,76B,104C,170C 'stack-alloc':103C 'store':144C 'sysf':73B,174C 'tipd':90C 'tps6598x':7A,33B,97C,99C 'type':5A,36B 'type-c':4A,35B 'typec':28B,89C,93C,106C,110C,121C,149C 'uniniti':45B,92C,162C 'unset':138C 'usb':3A,27B,34B,65B,88C,116C,155C,166C 'usb-typec':26B 'vulner':84C 'zero':176C,190C 'zero-initi':175C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the TI TPS6598x USB Type-C port controller driver (usb: typec: tipd), typically laptops or boards using that controller. Systems without this hardware or driver are not affected. The sources do not say which kernel versions are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98760","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98760","severity":null,"published_at":"2026-10-18T16:17:29+00:00","modified_at":"2026-10-21T13:21:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}