CVE-2026-53305: Linux ps883x USB Type-C Retimer Kernel Oops on Device Unbind

Technical summary

CVE-2026-53305 is a null pointer dereference vulnerability in the ps883x USB Type-C retimer driver within the Linux kernel. During probe, the driver fails to call i2c_set_clientdata() to associate the driver's private data structure with the i2c_client device. When the device is later unbound, ps883x_retimer_remove() invokes i2c_get_clientdata() expecting to retrieve this data pointer, but receives NULL instead. The subsequent dereference of this null pointer at offset 0x20 results in a kernel data abort exception (ESR 0x96000004), causing a fatal oops. The vulnerability manifests only during device unbind operations, making it reproducible through explicit driver unbind commands or when reassigning hardware to alternate kernel drivers.

Business impact

This vulnerability creates service availability risk for systems using PS8833x USB Type-C retimers—commonly found in enterprise laptops and workstations. An authenticated local user can trigger a kernel panic by unbinding the device, leading to unscheduled downtime and potential data loss if the crash occurs during critical workloads. Organizations that support device pass-through to virtual machines or frequently hot-swap USB Type-C hardware are at elevated risk. The crash is repeatable and deterministic, making it a reliable denial-of-service vector for privileged users or attackers who have gained local access.

Affected systems

Linux kernels with the ps883x USB Type-C retimer driver compiled and active. The vulnerability affects systems equipped with PS8833x retimer hardware. Version specificity requires verification against upstream kernel commit histories, but the flaw is present in versions where the driver exists without the i2c_set_clientdata() call. Arm-based systems (indicated by the aarch64 crash context in the CVE description) and x86 platforms running affected kernel versions are vulnerable.

Exploitability

Exploitation requires local code execution and privilege sufficient to unbind platform drivers—typically requiring root or CAP_SYS_ADMIN capabilities, though some distributions may expose this via unprivileged device management interfaces. No authentication bypass or privilege escalation is needed to trigger the crash once local access is obtained. The vulnerability is straightforward to exploit: a simple sysfs write command unbinding the device forces the oops. Remote exploitation is not possible. The barrier to successful exploitation is moderate due to the local privilege requirement, but the impact once triggered is certain and immediate.

Remediation

Apply a kernel update that includes the fix: the addition of i2c_set_clientdata(client, data) call at the end of the ps883x probe function. This ensures the driver data pointer is properly registered with the i2c subsystem, allowing the remove function to safely retrieve and use it. Verify the patched kernel version against your vendor's or the upstream Linux kernel security advisories. No workaround is available short of unloading the ps883x driver or avoiding unbind operations. Recompiling the kernel with the driver disabled is a temporary mitigation for non-critical systems.

Patch guidance

Apply the latest kernel security update from your distribution that resolves CVE-2026-53305. For upstream users, ensure your kernel includes the commit that adds i2c_set_clientdata() to ps883x_probe(). Verify the patch details against the upstream Linux kernel repository or your vendor's security advisory to confirm the exact version. After patching, reboot to activate the fixed kernel. If kernel live-patching is available for your environment, that may provide immediate remediation without reboot, but verify your live-patching framework supports this specific fix.

Detection guidance

Monitor kernel logs for NULL pointer dereference oops messages originating from ps883x_retimer_remove() or the i2c subsystem during device unbind operations. Systems with USB Type-C hardware and the ps883x driver loaded are candidates for scanning. Check running kernel version and module list: verify if ps883x is loaded via lsmod and confirm kernel version contains the fix. Operational detection is challenging without triggering the crash; proactive patching is more reliable than runtime detection. If suspicious unbind attempts are observed on systems with this hardware, isolate and patch immediately.

Why prioritize this

This is a straightforward kernel denial-of-service vulnerability affecting a real hardware driver used in enterprise laptops. Although exploitation requires local access and elevated privilege, the impact—kernel panic and service unavailability—is severe. The ease of reproduction and deterministic nature of the crash make this a practical risk for organizations supporting device assignment to virtual machines, hardware testing labs, or environments where users have local administrative access. The CVSS 5.5 MEDIUM severity reasonably reflects the privilege barrier, but business context may elevate priority in affected environments.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects an attack vector limited to local systems (AV:L), no privilege escalation needed but requiring already-present low privileges (PR:L), no user interaction (UI:N), and an impact limited to availability (A:H). The scoring penalizes the vulnerability for its strict local requirement while crediting the certainty and severity of the denial-of-service impact. In environments where device unbinding is a routine operation or where elevated-privilege users are numerous, actual risk may be perceived as higher; conversely, in locked-down production systems, risk is lower.

Frequently asked questions