CVE Explorer

CVE-2026-64329

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(), which on a connector-change event calls ucsi_connector_change() and schedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees uc->ucsi (kfree) before free_irq() is called, so a handler invocation already in flight may access the freed object after ucsi_destroy(). CPU 0 (remove)

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d3fef63753fd9583a587965aac14dcec6a845a1b941cf17df6b5cc77b8739878

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/typec/ucsi/ucsi_ccg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f1adeb1ff8bef1467d6961059810795d02bbad5d","status":"affected","version":"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2","versionType":"git"},{"lessThan":"99381e762273a2410a3f0216000be32b013c0ea9","status":"affected","version":"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2","versionType":"git"},{"lessThan":"1a160076d3d0dcd4a98a4599ad96eec0790b099b","status":"affected","version":"e32fd989ac1c…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/typec/ucsi/ucsi_ccg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"}…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/affected/1

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:aee9de8edec082bf839147e56002ce77541752acb659724ced6867e2af37d736 · sha256:c06d3efda1f74f07… · /containers/cna/references/5

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer