CVE-2026-90028 usb: typec: hd3ss3220: track VBUS enable state per consumer
A race condition in the Linux kernel USB Type-C driver can cause unbalanced regulator references, leading to system warnings or potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90028?
CVE-2026-90028 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: hd3ss3220: track VBUS enable state per consumer
regulator_is_enabled() reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can skip its own regulator_enable() call and later attempt to drop a reference it never acquired, triggering an unbalanced regulator disable warning.
Track successful enable and disable calls locally. Keep the state unchanged when an operation fails so a later role or ID notification retries the operation while this consumer keeps balanced references.
Which versions are affected by CVE-2026-90028?
How do I fix CVE-2026-90028?
Apply the vendor's patch.
Is CVE-2026-90028 being exploited?
There is no known exploitation of CVE-2026-90028 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-90028, GHSA-j5fw-mf6r-x735, UBUNTU-CVE-2026-90028.