CVE-2026-53028: Linux Kernel USB Type-C Driver Null Pointer Crash

Technical summary

CVE-2026-53028 is a use-after-error vulnerability in the Linux kernel's USB Type-C TI TUSB322 driver (drivers/usb/typec/tipd/core.c). The `cd321x_update_work()` function calls `typec_register_partner()` and checks the result with `IS_ERR()` to detect registration failure. However, when an error is detected, the code logs a warning but fails to return; execution continues to the subsequent `if (desc.identity)` block, which dereferences the error pointer via `typec_partner_set_identity(tps->partner)`. This violates the contract of error pointer handling in the kernel and results in a NULL pointer dereference or invalid memory access. The defect was identified by Smatch static analysis.

Business impact

A local attacker or unprivileged user can trigger this vulnerability by manipulating USB Type-C device attachment conditions on affected systems, causing a kernel oops and denial of service. The vulnerability requires local access and normal user privileges to trigger. Systems relying on USB Type-C connectivity for docking, charging, or device communication may experience unexpected crashes during partner device registration, disrupting workflow and potentially causing data loss if the system is in the middle of critical operations.

Affected systems

The Linux kernel is affected in versions containing the vulnerable TI TUSB322 USB Type-C driver code. Systems running Linux kernels with USB Type-C support enabled and utilizing TI TUSB322 controllers are at risk. This includes modern laptops, docking stations, and embedded systems with USB Type-C ports. The vulnerability was published 24 June 2026 and modified 15 July 2026; check your Linux distribution's advisory for which kernel versions in your environment contain this code path.

Exploitability

Exploitability is moderate. The vulnerability requires local system access and the ability to trigger USB Type-C device attachment events, which a normal unprivileged user can perform by physically connecting or removing USB Type-C devices. No authentication is required beyond local user access. The crash is deterministic and reproducible by attaching certain USB Type-C peripherals or docks. Public exploitation code has not been published; however, the fix is straightforward and the root cause is clear from the source code, making this vulnerability discoverable without significant effort.

Remediation

Apply kernel updates from your Linux distribution that include the fix for CVE-2026-53028. The upstream Linux kernel fix adds an early return statement when `IS_ERR(tps->partner)` is true, preventing dereference of the error pointer. Verify that the patched kernel version distributed by your vendor includes the corrected code in drivers/usb/typec/tipd/core.c. For systems that cannot be immediately updated, restrict physical USB Type-C port access to trusted users if operationally feasible.

Patch guidance

Contact your Linux distribution vendor (Red Hat, Ubuntu, Debian, etc.) or check the upstream Linux kernel stable branches for the committed fix. The patch is minimal: addition of a return statement in the error handling path of `cd321x_update_work()`. The fix also corrects a spelling error in the warning message ('partnet' → 'partner'). Patch availability and version numbers vary by distribution; verify the specific kernel version in your environment against your vendor's security advisory.

Detection guidance

Monitor system logs for kernel oops messages originating from drivers/usb/typec/tipd/core.c or the TI TUSB322 driver during USB Type-C device attachment events. Such crashes may appear as 'NULL pointer dereference' or 'BUG: unable to handle page fault' in dmesg. Runtime kernel configuration auditing is of limited value here; focus on kernel version verification and patch status. For continuous monitoring, check whether your systems are running patched kernel versions and track USB device attachment patterns in environments where Type-C peripherals are frequently used.

Why prioritize this

Assign medium priority. The CVSS score of 5.5 reflects local-only attack surface and availability impact, but the ease of triggering via physical USB attachment in shared-access environments (labs, offices, hoteling spaces) elevates operational risk. Systems where unprivileged users have routine physical access to USB Type-C ports or docking stations should be prioritized for patching. Systems in restricted physical environments or with USB port access controls may be deprioritized.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (AV:L)—physical USB attachment is required; Access Complexity Low (AC:L)—trivial to trigger; Privileges Required Low (PR:L)—normal user can cause crash; User Interaction None (UI:N)—no user interaction needed beyond device attachment; Scope Unchanged (S:U)—impact confined to the affected system; Confidentiality None (C:N)—no data exposure; Integrity None (I:N)—no data corruption; Availability High (A:H)—kernel crash causes DoS. The score does not reflect privilege escalation potential, only denial of service.

Frequently asked questions