CVE-2026-64329

A flaw was found in the Linux kernel's USB Type-C UCSI CCG driver. A use-after-free vulnerability occurs during the removal of a USB Type-C device. Specifically, the system attempts to free a memory object before ensuring that all related interrupt handling routines have completed. This timing issue could allow an attacker to potentially access freed memory, leading to system instability or a denial of service.

A use-after-free can occur in the USB Type-C UCSI CCG remove path because ucsi_destroy can free the ucsi object before free_irq waits for a threaded IRQ handler that may already be running. The in flight ccg_irq_handler can call ucsi_notify_common with the freed ucsi pointer and may schedule connector change handling, creating a race between device removal and interrupt processing. For the CVSS the PR:L is used for the paranoid score because reliable triggering normally requires local ability to influence driver removal, device unbind, module unload, or a privileged service path rather than remote packet access. The issue is not network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.