In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmic_glink… (CVE-2026-98758)

The Linux kernel's USB Type-C UCSI glink client had a use-after-free vulnerability triggered during device removal. The pmic_glink client is released by devres cleanup after the pmic_glink_ucsi_remove() function returns, allowing notification callbacks to queue work that executes after ucsi_unregister() has freed memory. This results in work items accessing freed connector arrays or attempting to register/unregister the instance multiple times. The fix disables pending work with disable_work_sync() before unregistering and checks the registration state to prevent double unregistering. This vulnerability was discovered via static analysis.

Exploitation of this vulnerability could lead to kernel memory corruption due to use-after-free conditions, potentially causing system instability or crashes. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by disabling work items before unregistering and verifying the registration state. Users should apply the official kernel updates that include this fix. Since this is not a cloud service, remediation depends on updating affected Linux kernel versions once patches are released. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.