CVE-2026-100079

A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) driver. This vulnerability can result in a Denial of Service (DoS) or system instability due to improper resource cleanup during device teardown. Debug filesystem (debugfs) entries created during registration are not removed when unregistering the interface, remaining active until the instance is destroyed. When a driver unregisters and re-registers the same interface across subsystem restarts, the kernel attempts to recreate existing entries, which can cause driver operational failures.

A low impact flaw was found in the Linux kernel USB Type-C Connector System Software Interface (UCSI) driver. Per-instance debugfs entries created by ucsi_register() are not removed by ucsi_unregister() and remain in place until the instance is destroyed. When a driver such as ucsi_glink unregisters and re-registers the same UCSI instance across a remoteproc subsystem restart, the kernel attempts to create an already-existing debugfs directory, which fails and can leave the driver in an incorrect state, resulting in a local denial of service or system instability. Triggering this condition requires local access with elevated privileges to cause device unregistration/re-registration or a subsystem restart. Red Hat Enterprise Linux 6, 7, and 8, as well as RHEL 9.2 and 9.4 and older OpenShift RHEL CoreOS builds, are not affected because the vulnerable code is not present in those streams. For the affected streams (RHEL 9.6 and later, RHEL 10, Red Hat In-Vehicle OS 2, and OpenShift versions based on RHEL CoreOS 9 from 4.19 onward), the fix is deferred to a future update because the flaw has low security impact and the residual risk is limited to debugfs state errors and UCSI driver operational degradation after subsystem restarts, with no memory corruption, privilege escalation, or information disclosure. Although the upstream/NIST CVSS 3.1 score is 5.5 (Moderate), Red Hat assesses the impact as Low because exploitation requires local privileged actions and the consequence is confined to driver/debugfs operational failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.