---
id: CVE-2026-98758
title: >-
  kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
  (CVE-2026-98758)
summary: >-
  A flaw was found in the Linux kernel's USB Type-C Connector System Software
  Interface (UCSI) GLINK driver. A local attacker with administrative privileges
  could trigger this flaw during device removal, leading to a Denial of Service
  (DoS) …
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-825
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad <
    432b58cd959e594909a581b4974396cdbc9d4ca1
  - >-
    Linux >= 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad <
    41934f92e7a54d4080ac0b17aacc83224946785c
  - >-
    Linux >= 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad <
    ee8577de01c6b6c7dd1d76b52242c54d37a989f4
  - >-
    Linux >= 62b5412b1f4afab27d8df90ddcabb8e1e11a00ad <
    63b269ec537dc0fd26d0bd64872c26860d108c9d
  - Linux 6.4
published: '2026-10-18'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T05:21:37+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98758.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98758.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98758'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555188'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98758'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98758'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98758.mbox
  - url: 'https://git.kernel.org/stable/c/432b58cd959e594909a581b4974396cdbc9d4ca1'
  - url: 'https://git.kernel.org/stable/c/41934f92e7a54d4080ac0b17aacc83224946785c'
  - url: 'https://git.kernel.org/stable/c/ee8577de01c6b6c7dd1d76b52242c54d37a989f4'
  - url: 'https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00168
epssPercentile: 0.06142
ingestedAt: '2026-10-18T16:47:32.497Z'
---

## Overview

A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) GLINK driver. A local attacker with administrative privileges could trigger this flaw during device removal, leading to a Denial of Service (DoS) or potentially arbitrary code execution. The issue occurs because background callback tasks can continue to queue and run after the driver has unregistered its resources, causing the system to access memory that has already been freed.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98758.json)

**kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.