Uninitialized Type-C Partner Descriptor in Linux Kernel - CVE-2026-98759
Summary
DEBIAN-CVE-2026-98759: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() cd321x_update_work() passes a stack-allocated typec_partner_desc to typec... Affects linux versions < 7.2.10-1. Fixed in 7.2.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It manages system resources, facilitates communication between hardware and software, and supports various file systems and network protocols. This vulnerability specifically affects the USB Type-C functionality, where improper initialization of a data structure can lead to serious security issues.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the USB Type-C driver, specifically within the cd321x_update_work() function. This function passes an uninitialized stack-allocated typec_partner_desc structure to typec_register_partner(). As a result, fields such as attach and detach remain unset, potentially leading to the invocation of garbage function pointers when a USB device is linked to the port. Additionally, uninitialized fields can leak sensitive stack data through the partner sysfs, posing a risk of information disclosure.
How To Fix
Minimum fixed version
7.2.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
CVE-2026-98759 represents a significant vulnerability in the Linux kernel's USB Type-C driver, stemming from uninitialized data structures. It is crucial for users to update their systems to the patched version to mitigate potential security risks. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for linux →
FAQ
CVE-2026-98759 is a vulnerability in the Linux kernel related to uninitialized data structures in the USB Type-C driver, which can lead to security risks.
This vulnerability can lead to the invocation of garbage function pointers and potential information leakage through the partner sysfs, which may compromise system security.
You should update your Linux package to version 7.2.10-1 or later to ensure that the vulnerability is patched.
As of now, there are no publicly known exploits for CVE-2026-98759, but it is advisable to apply the patch to prevent potential exploitation.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can also check if your application is affected by this vulnerability using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
