CVE-2026-98760 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
An attacker with physical access can trigger uninitialized memory usage in the TPS6598x USB Type-C driver, potentially leaking stack data or executing arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-98760?
CVE-2026-98760 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity.
typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs.
Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.
Which versions are affected by CVE-2026-98760?
How do I fix CVE-2026-98760?
Apply the vendor's patch.
Is CVE-2026-98760 being exploited?
There is no known exploitation of CVE-2026-98760 in the wild and no public exploit code.
Sources
Also known as AZL-109269, BELL-CVE-2026-98760, DEBIAN-CVE-2026-98760, GHSA-f983-5vc9-m6xh, UBUNTU-CVE-2026-98760.