CVE-2026-64329
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(), which on a connector-change event calls ucsi_connector_change() and schedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees uc->ucsi (kfree) before free_irq() is called, so a handler invocation already in flight may access the freed object after ucsi_destroy(). CPU 0 (remove) | CPU 1 (threaded IRQ) ucsi_destroy(uc->ucsi) | ccg_irq_handler() kfree(ucsi) // FREE | ucsi_notify_common(uc->ucsi) // USE Move free_irq() before ucsi_destroy() in the remove path. It is kept after ucsi_unregister(): ucsi_unregister() cancels connector work whose handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(), which waits for a completion that is signalled from the IRQ handler, so the IRQ must stay active until that work has been cancelled. The probe error path already orders free_irq() before ucsi_destroy(). This bug was found by static analysis.
INFO
Published Date :
July 25, 2026, 10:17 a.m.
Last Modified :
Aug. 17, 2026, 5:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Reorder free_irq() before ucsi_destroy() in remove path.
- Ensure IRQ remains active until work cancellation.
- Verify probe error path ordering.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64329.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64329 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64329
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64329 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64329 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'f1adeb1ff8bef1467d6961059810795d02bbad5d', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '99381e762273a2410a3f0216000be32b013c0ea9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '1a160076d3d0dcd4a98a4599ad96eec0790b099b', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'c32df11147822d22facee8fa30c2e8971d12f426', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '86c9ee928c4a370e323e432aaf8dca79c4ba7c85', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'f5c772b76bbd95de8be51cf849c6098f6af6fcf9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'dbb500bad02146b388041877574829016591ddc8', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '1f0bdc2884b67de337215079bba166df0cdf4ac5', 'versionType': 'git'}], 'programFiles': ['drivers/usb/typec/ucsi/ucsi_ccg.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.5'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/usb/typec/ucsi/ucsi_ccg.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'f1adeb1ff8bef1467d6961059810795d02bbad5d', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '99381e762273a2410a3f0216000be32b013c0ea9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '1a160076d3d0dcd4a98a4599ad96eec0790b099b', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'c32df11147822d22facee8fa30c2e8971d12f426', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '86c9ee928c4a370e323e432aaf8dca79c4ba7c85', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'f5c772b76bbd95de8be51cf849c6098f6af6fcf9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'dbb500bad02146b388041877574829016591ddc8', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '1f0bdc2884b67de337215079bba166df0cdf4ac5', 'versionType': 'git'}], 'programFiles': ['drivers/usb/typec/ucsi/ucsi_ccg.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.5'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/usb/typec/ucsi/ucsi_ccg.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'f1adeb1ff8bef1467d6961059810795d02bbad5d', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '99381e762273a2410a3f0216000be32b013c0ea9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '1a160076d3d0dcd4a98a4599ad96eec0790b099b', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'c32df11147822d22facee8fa30c2e8971d12f426', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '86c9ee928c4a370e323e432aaf8dca79c4ba7c85', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'f5c772b76bbd95de8be51cf849c6098f6af6fcf9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': 'dbb500bad02146b388041877574829016591ddc8', 'versionType': 'git'}, {'status': 'affected', 'version': 'e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2', 'lessThan': '1f0bdc2884b67de337215079bba166df0cdf4ac5', 'versionType': 'git'}], 'programFiles': ['drivers/usb/typec/ucsi/ucsi_ccg.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.5'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/usb/typec/ucsi/ucsi_ccg.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(), which on a connector-change event calls ucsi_connector_change() and schedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees uc->ucsi (kfree) before free_irq() is called, so a handler invocation already in flight may access the freed object after ucsi_destroy(). CPU 0 (remove) | CPU 1 (threaded IRQ) ucsi_destroy(uc->ucsi) | ccg_irq_handler() kfree(ucsi) // FREE | ucsi_notify_common(uc->ucsi) // USE Move free_irq() before ucsi_destroy() in the remove path. It is kept after ucsi_unregister(): ucsi_unregister() cancels connector work whose handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(), which waits for a completion that is signalled from the IRQ handler, so the IRQ must stay active until that work has been cancelled. The probe error path already orders free_irq() before ucsi_destroy(). This bug was found by static analysis. Added Reference https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b Added Reference https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5 Added Reference https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85 Added Reference https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9 Added Reference https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426 Added Reference https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8 Added Reference https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d Added Reference https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9