CVE-2026-74441

A flaw was found in the Linux kernel's USB Type-C UCSI driver. This vulnerability arises from a timing issue during the unregistration of USB Type-C ports, where certain operations can race against the destruction of internal work queues. A local attacker could exploit this race condition to trigger a use-after-free error, which involves accessing memory after it has been released. This can lead to system crashes (Denial of Service) and potentially allow for arbitrary code execution.

A race in the USB Type-C UCSI port teardown path can allow pending partner delayed work to run or be queued while connector resources and the workqueue are being unregistered. This can lead to use-after-free or double release behavior, with observed crashes in __queue_work and ucsi_poll_worker. For the CVSS the PR:L is used in the paranoid score because a local user or reduced capability device management context may be able to influence Type-C or UCSI lifecycle events, although reliable driver teardown is often administrator controlled. The issue is not network reachable and is triggered through local device lifecycle, error path, or unregistration conditions rather than packet traffic. Impact is at least local denial of service via kernel crash and in worst case may allow limited confidentiality or integrity impact due to memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.