{"id":"CVE-2026-98758","title":"kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (CVE-2026-98758)","summary":"A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) GLINK driver. A local attacker with administrative privileges could trigger this flaw during device removal, leading to a Denial of Service (DoS) …","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-825","vendor":"Red Hat","product":"Linux","affected":["Linux >= 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad < 432b58cd959e594909a581b4974396cdbc9d4ca1","Linux >= 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad < 41934f92e7a54d4080ac0b17aacc83224946785c","Linux >= 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad < ee8577de01c6b6c7dd1d76b52242c54d37a989f4","Linux >= 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad < 63b269ec537dc0fd26d0bd64872c26860d108c9d","Linux 6.4"],"published":"2026-10-18","updated":"2026-10-23","sourceUpdated":"2026-10-23T05:21:37+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98758.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98758.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98758"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555188"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98758"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98758"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98758.mbox"},{"url":"https://git.kernel.org/stable/c/432b58cd959e594909a581b4974396cdbc9d4ca1"},{"url":"https://git.kernel.org/stable/c/41934f92e7a54d4080ac0b17aacc83224946785c"},{"url":"https://git.kernel.org/stable/c/ee8577de01c6b6c7dd1d76b52242c54d37a989f4"},{"url":"https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00168,"epssPercentile":0.06014,"ingestedAt":"2026-10-18T16:47:32.497Z","slug":"CVE-2026-98758","body":"## Overview\n\nA flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) GLINK driver. A local attacker with administrative privileges could trigger this flaw during device removal, leading to a Denial of Service (DoS) or potentially arbitrary code execution. The issue occurs because background callback tasks can continue to queue and run after the driver has unregistered its resources, causing the system to access memory that has already been freed.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98758.json)\n\n**kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228161,"id":"CVE-2026-98758","ts":1792758138540,"field":"cvss","old":null,"new":"4.1"},{"seq":228160,"id":"CVE-2026-98758","ts":1792758138540,"field":"severity","old":"none","new":"medium"}]}