CVE-2026-98760

What it actually does

Uninitialized stack-allocated typec_partner_desc passed to typec_register_partner() leaves attach/deattach function pointers and other fields containing garbage values, enabling invocation of arbitrary code from typec_partner_link_device() and leaking stack data via sysfs.

Why it matters to the business

Kernel instability or potential privilege escalation on Linux systems using TPS6598x Type-C controllers when USB devices are attached, with risk amplified by the five-day-old disclosure requiring rapid patching across fleets.

How an attack unfolds

An attacker attaches a USB device to a vulnerable port; tps6598x_connect() registers the partner descriptor with uninitialized callbacks; later device linking invokes the garbage pointers, potentially executing attacker-controlled code or crashing the kernel.

How to fix it

Apply the upstream fix that zero-initializes the entire typec_partner_desc structure before calling typec_register_partner(); rebuild and deploy updated kernel images containing the corrected tps6598x_connect() implementation.

How to confirm the fix worked

Confirm the patch is present by inspecting the tps6598x_connect() function for explicit zero-initialization of the descriptor (e.g., via memset or designated initializers) and verify no uninitialized fields remain before the typec_register_partner() call.

Typical attack path

1. Physically or remotely trigger USB Type-C connection on affected hardware
2. tps6598x_connect() allocates and partially initializes typec_partner_desc on stack
3. typec_register_partner() copies uninitialized attach/deattach pointers
4. typec_partner_link_device() dereferences the garbage function pointers
5. Resulting execution of invalid code leads to crash or arbitrary kernel execution

How to detect it

Review kernel logs for unexpected crashes or oops in typec_partner_link_device() or tps6598x_connect() around USB attach events; inspect sysfs partner attributes for non-zero or anomalous pd_revision/usb_capability values immediately after device connection.

What your security team should do

• Prioritize kernel updates on all systems exposing TPS6598x Type-C ports within the next 7 days
• Monitor EPSS and exploit maturity indicators for any increase in public tooling
• Restrict physical USB access on high-value endpoints until patches are deployed
• Audit custom kernel builds for similar partial-initialization patterns in Type-C drivers