CVE-2026-90027 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of affected Linux kernel versions should assess exposure and apply patches if available. This includes reviewing system configurations to ensure the qcom-pmic-typec driver is properly configured and monitoring for potential exploitation attempts.

Why it matters

A use-after-free vulnerability in the Linux kernel's qcom-pmic-typec driver requires verification of affected versions and exploitation. Linux kernel developers and maintainers, Linux distribution maintainers, and users of affected Linux kernel versions should assess exposure and apply patches if available.

• Verify if Linux kernel versions are affected and apply patches if available
• Monitor for potential exploitation attempts
• Review system configurations to ensure the qcom-pmic-typec driver is properly configured

Technical summary

The Linux kernel's qcom-pmic-typec driver has a use-after-free vulnerability. The cc_debounce_dwork delayed work is not properly cancelled when the port is stopped, potentially leading to a use-after-free issue. This occurs because cc_debounce_dwork is queued from the set_cc() and start_toggling() callbacks, which run from TCPM's kthread worker. When port_stop() returns before tcpm_unregister_port() destroys that worker, flushing the worker during unregister may run a callback which queues the delayed work after port_stop() has returned.

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel versions to determine if they are affected by this vulnerability
• Verify if the qcom-pmic-typec driver is in use and apply patches if available
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The issue was found by an in-house static analysis tool. The CVE record and source item provide details about the vulnerability, but further verification is needed to confirm affected versions and exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.