CVE-2024-26932

What it actually does

Double-free in tcpm_port_unregister_pd() where the same PD capability structure is freed once by pd_capabilities_release() and again explicitly, triggering KASAN-detected invalid free during port registration/unregistration paths in the USB Type-C Power Delivery subsystem.

Why it matters to the business

Kernel instability or potential local privilege escalation on Linux systems handling USB-C PD devices, leading to crashes, denial of service, or elevated access on servers, embedded devices, and Android kernels; high prevalence in the Linux ecosystem increases exposure for downstream distributions and hardware vendors.

How an attack unfolds

An attacker with local access or ability to trigger deferred probe work (such as plugging compatible USB-C hardware) causes tcpm_register_port to invoke tcpm_port_unregister_pd during error paths, resulting in the double kfree; the freed memory can be reallocated to achieve code execution or crash the system.

How to fix it

Upgrade Linux kernel to version 6.8.3 or later, or apply commit 242e425ed580b2f4dbcb86c8fc03a410a4084a69 which removes the extraneous kfree from tcpm_port_unregister_pd(); rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version is at least 6.8.3; confirm absence of the double-free KASAN report in tcpm_port_unregister_pd during port registration testing; review dmesg or kernel logs for the removed kfree call site.

Typical attack path

1. Gain local access or control USB-C hardware attachment on target system
2. Trigger tcpm_register_port via tcpci_probe or equivalent port registration
3. Force error path that calls tcpm_port_unregister_pd while PD capabilities are still referenced
4. Exploit resulting double-free for memory corruption primitives leading to RCE or DoS

How to detect it

Search kernel logs and dmesg for KASAN double-free reports referencing tcpm_port_unregister_pd or pd_capabilities_release; inspect crash dumps for kfree calls on the same PD capability address during port registration; review audit logs for unexpected USB-C port attach/detach sequences preceding kernel oops.

• BUG: KASAN: double-free in tcpm_port_unregister_pd
• tcpm_port_unregister_pd+0x1a4/0x3dc
• Free of addr .* by task kworker/u16
• kasan_report_invalid_free

What your security team should do

• Prioritize kernel updates to 6.8.3+ on all affected Linux and Android devices within 30 days
• Monitor for local privilege escalation attempts via USB-C PD paths
• Restrict untrusted USB-C device attachment on high-value systems until patched
• Include double-free kernel patterns in internal fuzzing and KASAN-enabled test suites