In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe()… (CVE-2026-64463)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented in the Linux kernel source code to properly unregister the TCPCI port on probe failures and driver detach. Users should update to a kernel version that includes this fix once available. Patch status is not explicitly confirmed; check the vendor or Linux kernel advisories for the specific fixed versions and apply updates accordingly.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns without unregistering the TCPCI port. The explicit unregister currently only happens from the remove callback. Register a devres action immediately after tcpci_register_port() succeeds, so tcpci_unregister_port() runs on later probe failures and on driver detach. Drop the remove callback to avoid unregistering the same port twice. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Impact
If the probe function fails after registering the TCPCI port but before completing interrupt setup, the port remains registered improperly. This could lead to resource leaks or inconsistent driver state. There is no indication of direct exploitation or impact beyond resource management issues.
Summary
The Linux kernel vulnerability CVE-2026-64463 affects the usb: typec: tcpci_rt1711h driver. The rt1711h_probe() function registers the TCPCI port before requesting interrupts and enabling alert interrupts. If these subsequent steps fail, the probe function returns without unregistering the TCPCI port, which is only explicitly unregistered in the remove callback. The fix adds a devres action immediately after tcpci_register_port() succeeds, ensuring tcpci_unregister_port() is called on probe failures and driver detach, and removes the redundant unregister call in the remove callback. This issue was found through static analysis of kernel code.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64463 (opens in a new tab)
- git.kernel.org/stable/c/569f18a83eed0b0be4615f0c7bed40fb5c50e2e6 (opens in a new tab)
- git.kernel.org/stable/c/94b1abf1af94aa5a355e9f03675e07bccfc41c4b (opens in a new tab)
- git.kernel.org/stable/c/ce2e36e8759dfbfe546723810c306f42f484866d (opens in a new tab)
- git.kernel.org/stable/c/e5406c8fb71cd2f89a46300a746f6e7972e621e8 (opens in a new tab)
- git.kernel.org/stable/c/e8da46d99d3710106e7c44db14566bf9b57386b5 (opens in a new tab)