CVE-2026-64329

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

The threaded IRQ handler ccgirqhandler() calls ucsinotifycommon(), which on a connector-change event calls ucsiconnectorchange() and schedules connector work. In ucsiccgremove(), ucsidestroy() frees uc->ucsi (kfree) before freeirq() is called, so a handler invocation already in flight may access the freed object after ucsi_destroy().

CPU 0 (remove) | CPU 1 (threaded IRQ) ucsidestroy(uc->ucsi) | ccgirqhandler() kfree(ucsi) // FREE | ucsinotify_common(uc->ucsi) // USE

Move freeirq() before ucsidestroy() in the remove path. It is kept after ucsiunregister(): ucsiunregister() cancels connector work whose handler issues GETCONNECTORSTATUS through ucsisendcommand_common(), which waits for a completion that is signalled from the IRQ handler, so the IRQ must stay active until that work has been cancelled.

The probe error path already orders freeirq() before ucsidestroy().

This bug was found by static analysis.