CVE-2026-98759 usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
An attacker with physical access can trigger uninitialized memory usage in the Linux kernel USB Type-C driver, potentially leaking stack data or executing arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-98759?
CVE-2026-98759 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
cd321x_update_work() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity.
typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs.
Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.
Which versions are affected by CVE-2026-98759?
How do I fix CVE-2026-98759?
Apply the vendor's patch.
Is CVE-2026-98759 being exploited?
There is no known exploitation of CVE-2026-98759 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98759, DEBIAN-CVE-2026-98759, GHSA-34hh-4678-7488, UBUNTU-CVE-2026-98759.