CVE-2022-49944

In the Linux kernel, the following vulnerability has been resolved:

Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"

The recent commit 87d0e2f41b8c ("usb: typec: ucsi: add a common function ucsi_unregister_connectors()") introduced a regression that caused NULL dereference at reading the power supply sysfs. It's a stale sysfs entry that should have been removed but remains with NULL ops. The commit changed the error handling to skip the entries after a NULL con->wq, and this leaves the power device unreleased.

For addressing the regression, the straight revert is applied here. Further code improvements can be done from the scratch again.

This vulnerability is rated as Moderate impact because exploitation requires local system access on machines equipped with USB Type-C UCSI hardware and leads to a denial of service (system crash). Triggering the flaw requires an error during connector unregistration, leaving behind an orphaned power supply sysfs entry that causes a null pointer dereference when read. Standard enterprise server deployments typically lack this interface hardware, significantly reducing overall exposure in datacenter environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.