CVE-2026-64329: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(),
which on a connector-change event calls ucsi_connector_change() and
schedules connector work.  In ucsi_ccg_remove(), ucsi_destroy() frees
uc->ucsi (kfree) before free_irq() is called, so a handler invocation
already in flight may access the freed object after ucsi_destroy().

  CPU 0 (remove)            | CPU 1 (threaded IRQ)
    ucsi_destroy(uc->ucsi)  |   ccg_irq_handler()
      kfree(ucsi) // FREE   |     ucsi_notify_common(uc->ucsi) // USE

Move free_irq() before ucsi_destroy() in the remove path.  It is kept
after ucsi_unregister(): ucsi_unregister() cancels connector work whose
handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(),
which waits for a completion that is signalled from the IRQ handler, so
the IRQ must stay active until that work has been cancelled.

The probe error path already orders free_irq() before ucsi_destroy().

This bug was found by static analysis.

The Linux kernel CVE team has assigned CVE-2026-64329 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 and fixed in 5.10.261 with commit f1adeb1ff8bef1467d6961059810795d02bbad5d
	Issue introduced in 5.5 with commit e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 and fixed in 5.15.212 with commit 99381e762273a2410a3f0216000be32b013c0ea9
	Issue introduced in 5.5 with commit e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 and fixed in 6.1.178 with commit 1a160076d3d0dcd4a98a4599ad96eec0790b099b
	Issue introduced in 5.5 with commit e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 and fixed in 6.6.145 with commit c32df11147822d22facee8fa30c2e8971d12f426
	Issue introduced in 5.5 with commit e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 and fixed in 6.12.96 with commit 86c9ee928c4a370e323e432aaf8dca79c4ba7c85
	Issue introduced in 5.5 with commit e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 and fixed in 6.18.39 with commit f5c772b76bbd95de8be51cf849c6098f6af6fcf9
	Issue introduced in 5.5 with commit e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 and fixed in 7.1.4 with commit dbb500bad02146b388041877574829016591ddc8
	Issue introduced in 5.5 with commit e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 and fixed in 7.2-rc3 with commit 1f0bdc2884b67de337215079bba166df0cdf4ac5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64329
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/typec/ucsi/ucsi_ccg.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d
	https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9
	https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b
	https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426
	https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85
	https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9
	https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8
	https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5