The vulnerability (CVE-2026-64329) in the Linux kernel's USB Type-C UCSI driver is a use-after-free condition occurring during device removal. The threaded IRQ handler ccg_irq_handler calls ucsi_notify_common, which schedules connector work. However, in the remove path, ucsi_destroy frees the uc->ucsi object before free_irq is called, allowing the IRQ handler to access freed memory. The fix moves free_irq before ucsi_destroy to prevent this. This flaw affects Linux kernel versions prior to 7.0.0-31.31 and related builds. The patch is included in updated Ubuntu kernel packages as per the vendor advisory.

Exploitation of this use-after-free vulnerability could lead to system instability or potential privilege escalation due to the kernel accessing freed memory. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild. The vulnerability affects local users with limited privileges (low attack complexity and privileges required).

A patch is available and has been released by the vendor. Users should update their Linux kernel packages to the fixed versions listed in the Ubuntu security notices (e.g., linux-image-7.0.0-31.31 and later). After updating, a system reboot is required to apply the fix. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. No additional mitigation is required beyond applying the official update.