{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-68372 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-68372 is an use after free vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-68372 and fix it if it is affected.\n\nWhat it is: CVE-2026-68372 is an use after free vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-68372 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-68372/ (Markdown: https://insights.sbomify.com/CVE-2026-68372/index.md)","id":"CVE-2026-68372","markdown":"https://insights.sbomify.com/CVE-2026-68372/index.md","name":"CVE-2026-68372","record":{"aliases":["BELL-CVE-2026-68372","DEBIAN-CVE-2026-68372","GHSA-3j8g-7xhm-68vv","UBUNTU-CVE-2026-68372"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel USB","requires_auth":"none","summary":"A use-after-free in the Linux kernel USB Type-C driver causes system instability and network interface failure when Thunderbolt docks are unplugged.","user_interaction":"required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: port: Deattach Type-C connector on component unbind\n\nconnector_unbind() is the mirror of connector_bind(), but it is missing\nthe symmetric call to typec_deattach() that connector_bind() makes via:\n\n    if (port_dev-\u003echild)\n        typec_attach(port_dev-\u003econnector, \u0026port_dev-\u003echild-\u003edev);\n\nWhen a Thunderbolt dock is unplugged, two teardown paths race:\n\n1. The component framework calls connector_unbind() first, which sets\n   port_dev-\u003econnector = NULL without calling typec_deattach().  This\n   leaves port-\u003eusb2_dev/port-\u003eusb3_dev in struct typec_port pointing at\n   the USB device that is about to be freed.\n\n2. usb_disconnect() then calls typec_deattach(port_dev-\u003econnector, ...),\n   but port_dev-\u003econnector is already NULL, so the call is a no-op and\n   port-\u003eusb2_dev is never cleared.\n\n3. Concurrently, UCSI detects a PD partner-disconnect event and calls\n   typec_unregister_partner(), which reads port-\u003eusb2_dev (now a dangling\n   pointer to freed memory) and passes it to typec_partner_unlink_device()\n   -\u003e sysfs_remove_link() -\u003e dev_name() on the freed device, corrupting\n   the typec/UCSI partner state.\n\nThis corruption leaves the Thunderbolt tunnel in an inconsistent state on\nthe next dock hot-plug.  On affected hardware the dock's I225/igc NIC fails\nto enumerate: AER fires a slot reset while the igc driver is still\ninitialising (\"PCIe link lost\"), and the subsequent igc_reset attempt hits\nigc_rd32 on an already-detached device:\n\n    igc 0000:2e:00.0 eth0: PCIe link lost, device now detached\n    igc: Failed to read reg 0x0!\n    WARNING: CPU: 9 PID: 129 at drivers/net/ethernet/intel/igc/igc_main.c:7005\n             igc_rd32+0xa4/0xc0 [igc]\n    Call Trace:\n     igc_disable_pcie_master+0x16/0xa0 [igc]\n     igc_reset_hw_base+0x14/0x170 [igc]\n     igc_reset+0x63/0x110 [igc]\n     igc_io_slot_reset+0x9e/0xd0 [igc]\n     report_slot_reset+0x5d/0xc0\n     pcie_do_recovery+0x209/0x400\n     aer_isr_one_error_type+0x235/0x430\n     aer_isr+0x4e/0x80\n     irq_thread+0xf4/0x1f0\n\n4. UCSI later handles the PD partner-disconnect and calls\n   typec_unregister_partner(), which still sees the stale port-\u003eusb2_dev\n   and tries to remove its sysfs link a second time:\n\n   kernfs: can not remove 'typec', no directory\n   WARNING: CPU: 6 PID: 55 at fs/kernfs/dir.c:1706 kernfs_remove_by_name_ns+0xe9/0xf0\n   Workqueue: events ucsi_handle_connector_change [typec_ucsi]\n   Call Trace:\n    sysfs_remove_link+0x19/0x50\n    typec_unregister_partner+0x6e/0x120 [typec]\n    ucsi_unregister_partner+0x107/0x150 [typec_ucsi]\n    ucsi_handle_connector_change+0x3ec/0x490 [typec_ucsi]\n    process_one_work+0x18e/0x3e0\n    worker_thread+0x2e3/0x420\n    kthread+0x10a/0x230\n    ret_from_fork+0x121/0x140\n    ret_from_fork_asm+0x1a/0x30\n\n   With worse timing the same stale pointer is dereferenced after the\n   backing memory is freed, turning the warning into a use-after-free.\n\nFix the asymmetry: call typec_deattach() before clearing\nport_dev-\u003econnector, matching what connector_bind() does on the bind side.\ntypec_partner_deattach() is already protected by port-\u003epartner_link_lock,\nso it serialises safely with the concurrent typec_unregister_partner() path.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"usb: core: port: Deattach Type-C connector on component unbind","id":"CVE-2026-68372","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()","id":"CVE-2026-68373"},"packages":[],"prev":{"headline":"usb: musb: omap2430: Do not put borrowed of_node in probe","id":"CVE-2026-68371"},"products":["Linux"],"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel USB Type-C driver causes system instability and network interface failure when Thunderbolt docks are unplugged.","url":"https://insights.sbomify.com/CVE-2026-68372/"}