OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-90026

HIGH · CVSS 7.8 EPSS 0.18%

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's handling of USB Type-C Qualcomm PMIC, specifically in the `pdphy_stop()` function, which improperly manages IRQs and pending reset work. This flaw can lead to use-after-free conditions, potentially allowing an attacker to execute arbitrary code or cause system instability. Organizations using affected Linux kernel versions should prioritize this issue to mitigate risks associated with system reliability and security.

CVE
CVE-2026-90026
Severity
HIGH
CVSS
7.8
EPSS
0.18%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel reset_work on stop pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ handler schedules it just before disable_irq(), the work runs after remove() frees the struct via devm. Call cancel_work_sync() after disabling IRQs to close the window. This issue was found by an in-house static analysis tool.