CVE-2024-40903 is a use-after-free vulnerability in the Linux kernel's USB Type-C Port Manager (tcpm) subsystem. It occurs in the function tcpm_register_source_caps when new source capabilities are advertised, existing capabilities are unregistered, and an error causes the function to return prematurely. This leaves a pointer to freed memory, potentially leading to memory corruption.