CVE-2026-53028
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
24/06/2026
Last modified:
15/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
usb: typec: Fix error pointer dereference<br />
<br />
The variable tps->partner is checked for an error pointer and then if it<br />
is, it sends an error message but does not return and then immediately<br />
dereferenced a few lines below:<br />
<br />
tps->partner = typec_register_partner(tps->port, &desc);<br />
if (IS_ERR(tps->partner))<br />
dev_warn(tps->dev, "%s: failed to register partnet\n", __func__);<br />
<br />
if (desc.identity) {<br />
typec_partner_set_identity(tps->partner);<br />
cd321x->cur_partner_identity = st.partner_identity;<br />
}<br />
<br />
Add early return and fix spelling mistake in error message.<br />
<br />
Detected by Smatch:<br />
drivers/usb/typec/tipd/core.c:827 cd321x_update_work() error:<br />
&#39;tps->partner&#39; dereferencing possible ERR_PTR()
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.18 (including) | 6.18.33 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19 (including) | 7.0.10 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



