CVE-2026-98758

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98758", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.368Z", "datePublished": "2026-10-18T15:47:46.209Z", "dateUpdated": "2026-10-19T09:25:11.783Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:25:11.783Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: glink: fix use-after-free of ucsi on remove\n\nThe pmic_glink client is released by the devres cleanup, which runs\nafter pmic_glink_ucsi_remove() has returned, so its notification\ncallbacks can queue work until then. Work that runs after\nucsi_unregister() has been called touches freed state: it dereferences\nthe connector array that ucsi_unregister() freed, or registers and\nunregisters the instance a second time.\n\nDisable both work items with disable_work_sync() before unregistering,\nand unregister only if the instance is still registered.\n\nThis issue was found by an in-house static analysis tool."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/ucsi/ucsi_glink.c"], "versions": [{"version": "62b5412b1f4afab27d8df90ddcabb8e1e11a00ad", "lessThan": "432b58cd959e594909a581b4974396cdbc9d4ca1", "status": "affected", "versionType": "git"}, {"version": "62b5412b1f4afab27d8df90ddcabb8e1e11a00ad", "lessThan": "41934f92e7a54d4080ac0b17aacc83224946785c", "status": "affected", "versionType": "git"}, {"version": "62b5412b1f4afab27d8df90ddcabb8e1e11a00ad", "lessThan": "ee8577de01c6b6c7dd1d76b52242c54d37a989f4", "status": "affected", "versionType": "git"}, {"version": "62b5412b1f4afab27d8df90ddcabb8e1e11a00ad", "lessThan": "63b269ec537dc0fd26d0bd64872c26860d108c9d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/ucsi/ucsi_glink.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/432b58cd959e594909a581b4974396cdbc9d4ca1"}, {"url": "https://git.kernel.org/stable/c/41934f92e7a54d4080ac0b17aacc83224946785c"}, {"url": "https://git.kernel.org/stable/c/ee8577de01c6b6c7dd1d76b52242c54d37a989f4"}, {"url": "https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d"}], "title": "usb: typec: ucsi: glink: fix use-after-free of ucsi on remove", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/typec/ucsi/ucsi_glink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "432b58cd959e594909a581b4974396cdbc9d4ca1", "status": "affected", "version": "62b5412b1f4afab27d8df90ddcabb8e1e11a00ad", "versionType": "git"}, {"lessThan": "41934f92e7a54d4080ac0b17aacc83224946785c", "status": "affected", "version": "62b5412b1f4afab27d8df90ddcabb8e1e11a00ad", "versionType": "git"}, {"lessThan": "ee8577de01c6b6c7dd1d76b52242c54d37a989f4", "status": "affected", "version": "62b5412b1f4afab27d8df90ddcabb8e1e11a00ad", "versionType": "git"}, {"lessThan": "63b269ec537dc0fd26d0bd64872c26860d108c9d", "status": "affected", "version": "62b5412b1f4afab27d8df90ddcabb8e1e11a00ad", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/typec/ucsi/ucsi_glink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: glink: fix use-after-free of ucsi on remove\n\nThe pmic_glink client is released by the devres cleanup, which runs\nafter pmic_glink_ucsi_remove() has returned, so its notification\ncallbacks can queue work until then. Work that runs after\nucsi_unregister() has been called touches freed state: it dereferences\nthe connector array that ucsi_unregister() freed, or registers and\nunregisters the instance a second time.\n\nDisable both work items with disable_work_sync() before unregistering,\nand unregister only if the instance is still registered.\n\nThis issue was found by an in-house static analysis tool."}], "id": "CVE-2026-98758", "lastModified": "2026-10-19T10:19:39.920", "metrics": {}, "published": "2026-10-18T16:17:29.607", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41934f92e7a54d4080ac0b17aacc83224946785c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/432b58cd959e594909a581b4974396cdbc9d4ca1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ee8577de01c6b6c7dd1d76b52242c54d37a989f4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove", "id": "2555188", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555188"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: typec: ucsi: glink: fix use-after-free of ucsi on remove\nThe pmic_glink client is released by the devres cleanup, which runs\nafter pmic_glink_ucsi_remove() has returned, so its notification\ncallbacks can queue work until then. Work that runs after\nucsi_unregister() has been called touches freed state: it dereferences\nthe connector array that ucsi_unregister() freed, or registers and\nunregisters the instance a second time.\nDisable both work items with disable_work_sync() before unregistering,\nand unregister only if the instance is still registered.\nThis issue was found by an in-house static analysis tool.", "A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) GLINK driver. A local attacker with administrative privileges could trigger this flaw during device removal, leading to a Denial of Service (DoS) or potentially arbitrary code execution. The issue occurs because background callback tasks can continue to queue and run after the driver has unregistered its resources, causing the system to access memory that has already been freed."], "name": "CVE-2026-98758", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98758\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98758\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98758.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[62b5412b1f4afab27d8df90ddcabb8e1e11a00ad,432b58cd959e594909a581b4974396cdbc9d4ca1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[62b5412b1f4afab27d8df90ddcabb8e1e11a00ad,41934f92e7a54d4080ac0b17aacc83224946785c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[62b5412b1f4afab27d8df90ddcabb8e1e11a00ad,ee8577de01c6b6c7dd1d76b52242c54d37a989f4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[62b5412b1f4afab27d8df90ddcabb8e1e11a00ad,63b269ec537dc0fd26d0bd64872c26860d108c9d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:00:20.106696+00:00", "updated": "2026-10-23T22:00:28.562283+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}