In the Linux kernel, the following vulnerability has been resolved:
usb: typec: qcom-pmic: cancel reset_work on stop
pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ
handler schedules it just before disable_irq(), the work runs after
remove() frees the struct via devm.
Call cancel_work_sync() after disabling IRQs to close the window.
This issue was found by an in-house static analysis tool.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The use-after-free is reached from local Qualcomm PMIC Type-C platform-driver teardown (sysfs unbind, rmmod, or probe unwind calling pdphy_stop), not from parsing USB host packets. That matches other USB/UDC teardown UAFs scored Local and is higher severity than Physical.
AC:L - A USB PD Hard Reset SIG_RX IRQ schedules reset_work, then pdphy_stop() only disable_irq() without cancel_work_sync, so the attacker can queue the work and immediately unbind/rebind until the worker runs on the freed pmic_typec_pdphy; such attacker-driven UAF races score AC:L.
PR:L - Per CNA driver-removal UAF precedent, an unprivileged local user on Qualcomm phones, laptops, and automotive systems using this PMIC Type-C controller can spray the freed pmic_typec_pdphy while privileged or automated teardown proceeds; init-namespace root is not required for the UAF itself.
UI:N - The attacker queues reset_work from in-flight SIG_RX and initiates driver removal themselves; no separate victim action such as plugging a USB cable, mounting a filesystem, or opening a device node is required.
S:U - The use-after-free corrupts the host kernel's pmic_typec_pdphy and tcpm_port heap objects within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.
C:H - qcom_pmic_typec_pdphy_sig_reset_work() recovers the freed pmic_typec_pdphy via container_of and reads its lock, regmap, and tcpm_port; reclaiming that slab yields a classic UAF read/disclosure primitive.
I:H - The dangling worker takes the freed lock, writes PD PHY registers through regmap, and calls tcpm_pd_hard_reset() on a possibly unregistered port, enabling heap corruption and control-flow hijack.
A:H - Dereferencing the freed pmic_typec_pdphy from workqueue context, or queueing TCPM work on a destroyed port worker, causes a kernel oops or panic even without a full exploit, so availability impact is High.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The use-after-free is reached from local Qualcomm PMIC Type-C platform-driver teardown (sysfs unbind, rmmod, or probe unwind calling pdphy_stop), not from parsing USB host packets. That matches other USB/UDC teardown UAFs scored Local and is higher severity than Physical.
AC:L - A USB PD Hard Reset SIG_RX IRQ schedules reset_work, then pdphy_stop() only disable_irq() without cancel_work_sync, so the attacker can queue the work and immediately unbind/rebind until the worker runs on the freed pmic_typec_pdphy; such attacker-driven UAF races score AC:L.
PR:L - Per CNA driver-removal UAF precedent, an unprivileged local user on Qualcomm phones, laptops, and automotive systems using this PMIC Type-C controller can spray the freed pmic_typec_pdphy while privileged or automated teardown proceeds; init-namespace root is not required for the UAF itself.
UI:N - The attacker queues reset_work from in-flight SIG_RX and initiates driver removal themselves; no separate victim action such as plugging a USB cable, mounting a filesystem, or opening a device node is required.
S:U - The use-after-free corrupts the host kernel's pmic_typec_pdphy and tcpm_port heap objects within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.
C:H - qcom_pmic_typec_pdphy_sig_reset_work() recovers the freed pmic_typec_pdphy via container_of and reads its lock, regmap, and tcpm_port; reclaiming that slab yields a classic UAF read/disclosure primitive.
I:H - The dangling worker takes the freed lock, writes PD PHY registers through regmap, and calls tcpm_pd_hard_reset() on a possibly unregistered port, enabling heap corruption and control-flow hijack.
A:H - Dereferencing the freed pmic_typec_pdphy from workqueue context, or queueing TCPM work on a destroyed port worker, causes a kernel oops or panic even without a full exploit, so availability impact is High.
CVSS 3.1