CVE-2026-68372

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: core: port: Deattach Type-C connector on component unbind<br /> <br /> connector_unbind() is the mirror of connector_bind(), but it is missing<br /> the symmetric call to typec_deattach() that connector_bind() makes via:<br /> <br /> if (port_dev-&gt;child)<br /> typec_attach(port_dev-&gt;connector, &amp;port_dev-&gt;child-&gt;dev);<br /> <br /> When a Thunderbolt dock is unplugged, two teardown paths race:<br /> <br /> 1. The component framework calls connector_unbind() first, which sets<br /> port_dev-&gt;connector = NULL without calling typec_deattach(). This<br /> leaves port-&gt;usb2_dev/port-&gt;usb3_dev in struct typec_port pointing at<br /> the USB device that is about to be freed.<br /> <br /> 2. usb_disconnect() then calls typec_deattach(port_dev-&gt;connector, ...),<br /> but port_dev-&gt;connector is already NULL, so the call is a no-op and<br /> port-&gt;usb2_dev is never cleared.<br /> <br /> 3. Concurrently, UCSI detects a PD partner-disconnect event and calls<br /> typec_unregister_partner(), which reads port-&gt;usb2_dev (now a dangling<br /> pointer to freed memory) and passes it to typec_partner_unlink_device()<br /> -&gt; sysfs_remove_link() -&gt; dev_name() on the freed device, corrupting<br /> the typec/UCSI partner state.<br /> <br /> This corruption leaves the Thunderbolt tunnel in an inconsistent state on<br /> the next dock hot-plug. On affected hardware the dock&amp;#39;s I225/igc NIC fails<br /> to enumerate: AER fires a slot reset while the igc driver is still<br /> initialising ("PCIe link lost"), and the subsequent igc_reset attempt hits<br /> igc_rd32 on an already-detached device:<br /> <br /> igc 0000:2e:00.0 eth0: PCIe link lost, device now detached<br /> igc: Failed to read reg 0x0!<br /> WARNING: CPU: 9 PID: 129 at drivers/net/ethernet/intel/igc/igc_main.c:7005<br /> igc_rd32+0xa4/0xc0 [igc]<br /> Call Trace:<br /> igc_disable_pcie_master+0x16/0xa0 [igc]<br /> igc_reset_hw_base+0x14/0x170 [igc]<br /> igc_reset+0x63/0x110 [igc]<br /> igc_io_slot_reset+0x9e/0xd0 [igc]<br /> report_slot_reset+0x5d/0xc0<br /> pcie_do_recovery+0x209/0x400<br /> aer_isr_one_error_type+0x235/0x430<br /> aer_isr+0x4e/0x80<br /> irq_thread+0xf4/0x1f0<br /> <br /> 4. UCSI later handles the PD partner-disconnect and calls<br /> typec_unregister_partner(), which still sees the stale port-&gt;usb2_dev<br /> and tries to remove its sysfs link a second time:<br /> <br /> kernfs: can not remove &amp;#39;typec&amp;#39;, no directory<br /> WARNING: CPU: 6 PID: 55 at fs/kernfs/dir.c:1706 kernfs_remove_by_name_ns+0xe9/0xf0<br /> Workqueue: events ucsi_handle_connector_change [typec_ucsi]<br /> Call Trace:<br /> sysfs_remove_link+0x19/0x50<br /> typec_unregister_partner+0x6e/0x120 [typec]<br /> ucsi_unregister_partner+0x107/0x150 [typec_ucsi]<br /> ucsi_handle_connector_change+0x3ec/0x490 [typec_ucsi]<br /> process_one_work+0x18e/0x3e0<br /> worker_thread+0x2e3/0x420<br /> kthread+0x10a/0x230<br /> ret_from_fork+0x121/0x140<br /> ret_from_fork_asm+0x1a/0x30<br /> <br /> With worse timing the same stale pointer is dereferenced after the<br /> backing memory is freed, turning the warning into a use-after-free.<br /> <br /> Fix the asymmetry: call typec_deattach() before clearing<br /> port_dev-&gt;connector, matching what connector_bind() does on the bind side.<br /> typec_partner_deattach() is already protected by port-&gt;partner_link_lock,<br /> so it serialises safely with the concurrent typec_unregister_partner() path.