CVE-2026-53028

What it actually does

This is a Linux kernel USB Type-C driver flaw in the TPS6598x / TI PD controller code path where a failed call to typec_register_partner() can leave tps->partner holding an error pointer. The vulnerable code logs a warning but continues execution and may pass that error pointer to typec_partner_set_identity(), causing an invalid kernel pointer dereference. The most likely technical result is a local denial of service through a kernel oops, panic, or instability when the affected USB Type-C partner registration path is exercised. Based on the available description, there is no evidence of reliable privilege escalation, remote code execution, or data disclosure.

Why it matters to the business

Systems using affected Linux kernels with the impacted USB Type-C controller driver may crash or become unstable when specific USB Type-C connection or partner-identity handling paths are triggered. For laptops, workstations, embedded devices, kiosks, or appliances that rely on USB-C connectivity, this can cause unplanned downtime, user disruption, support incidents, or device availability issues. The current EPSS score is very low, it is not listed in CISA KEV, it is not known to be used in ransomware campaigns, and no public exploit maturity is indicated, so urgency is lower than internet-facing remote execution issues; however, kernel updates should still be included in normal patch cycles, especially for fleets with exposed or user-accessible USB-C ports.

How an attack unfolds

An attacker would need a way to trigger the affected USB Type-C partner registration path on a vulnerable Linux system. In a realistic scenario, this would usually require local physical access or control over a USB-C device or accessory that influences USB Type-C Power Delivery identity handling. The attacker connects or emulates a USB-C partner that causes typec_register_partner() to fail while partner identity data remains present. Because the vulnerable kernel code does not return after detecting the error pointer, it later dereferences the invalid partner reference while setting identity information. This can crash the kernel or destabilize the system. There are no known named threat actors, ransomware campaigns, or mature public exploit chains reported for this issue in the supplied data.

How to fix it

Update to a Linux kernel build that includes the upstream fix for the USB Type-C TPS6598x driver error-pointer handling issue. The fix adds an early return after typec_register_partner() fails, preventing dereference of an ERR_PTR value. Because no specific affected products or fixed package versions were provided, remediation should be performed through the relevant Linux distribution, kernel vendor, appliance vendor, or embedded platform maintainer once their advisory packages are available. Where immediate patching is not possible, reduce exposure by limiting physical access to affected systems, restricting use of untrusted USB-C devices and docks, disabling unused USB-C/Type-C functionality where operationally feasible, and applying kernel hardening and panic recovery settings appropriate for the environment. Reboot into the updated kernel after installation; merely installing kernel packages without booting the fixed kernel is insufficient.

How to confirm the fix worked

Confirm that systems are running a vendor kernel version that includes the fix for the USB Type-C TPS6598x driver. Validate by checking the active kernel with uname -r and comparing it against the vendor advisory or package changelog. For source-based or custom kernels, verify that drivers/usb/typec/tipd/core.c returns immediately when typec_register_partner() returns IS_ERR(tps->partner), before any call that uses tps->partner such as typec_partner_set_identity(). Confirm that vulnerable kernels are no longer booted after patching. Where hardware is available, perform controlled USB-C attach/detach testing with representative docks, chargers, and devices and verify there are no kernel oops, WARN, or panic events related to cd321x_update_work(), typec_register_partner(), or typec_partner_set_identity().

Typical attack path

1. Identify a target system running an affected Linux kernel with the vulnerable USB Type-C TPS6598x/TI PD controller driver code reachable.
2. Obtain local physical access or another means to influence USB Type-C partner attachment and identity negotiation.
3. Connect or emulate a USB-C partner/device that drives the vulnerable cd321x_update_work() path and causes typec_register_partner() to return an error pointer.
4. Ensure the code path proceeds with partner identity handling despite the failed registration.
5. Trigger the invalid error-pointer dereference in the kernel.
6. Cause a kernel oops, panic, system crash, or Type-C subsystem instability.

How to detect it

To assess whether this issue may already have been triggered, review kernel and system logs for USB Type-C driver warnings, kernel oopses, panics, or crashes around the time of USB-C device attachment, dock connection, charger insertion, or power-delivery negotiation. Relevant log sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, crash dump directories, kdump/vmcore records, pstore/ramoops logs, and endpoint telemetry that records kernel panics or unexpected reboots. Look for messages referencing cd321x_update_work(), typec_register_partner(), typec_partner_set_identity(), drivers/usb/typec/tipd/core.c, the tipd driver, TPS6598x, TI PD controllers, or a warning similar to failed partner registration followed by a NULL/invalid pointer dereference, general protection fault, unable to handle kernel paging request, BUG, Oops, or panic. Also correlate unexpected reboots with physical access logs, helpdesk reports, USB-C dock/charger events, and device inventory changes. Because the vulnerability is a kernel error-pointer dereference and not a malware implant, there may be no persistent file, process, registry, or network IOC; evidence is most likely crash artifacts and kernel log strings.

• cd321x_update_work()
• typec_register_partner
• typec_partner_set_identity
• drivers/usb/typec/tipd/core.c
• failed to register partnet
• failed to register partner
• tps->partner
• dereferencing possible ERR_PTR
• tipd
• TPS6598x
• usb: typec
• Unable to handle kernel paging request
• general protection fault
• kernel BUG
• Oops:
• Kernel panic
• pstore
• ramoops
• vmcore

What your security team should do

• Inventory Linux systems, appliances, and embedded devices with USB-C/Type-C hardware that may use the affected kernel driver path.
• Prioritize patching for user-accessible devices, shared workstations, kiosks, industrial/embedded systems, and devices where a crash would cause operational disruption.
• Track vendor kernel advisories and deploy the fixed kernel through normal Linux update channels; ensure systems are rebooted into the fixed kernel.
• Until patched, restrict use of unknown USB-C accessories, docks, chargers, and test devices on sensitive or high-availability systems.
• Monitor kernel logs for Type-C subsystem warnings, oopses, or panics involving cd321x_update_work(), typec_register_partner(), typec_partner_set_identity(), or the tipd driver.
• Treat repeated crashes correlated with USB-C device insertion as potentially suspicious and preserve kernel logs for investigation.
• Because EPSS is low, KEV is false, and no exploit maturity is reported, handle as a standard kernel stability/security update rather than an emergency internet-wide exposure event unless local threat conditions elevate physical-access risk.