CVE-2026-68372

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: core: port: Deattach Type-C connector on component unbind

connector_unbind() is the mirror of connector_bind(), but it is missing

the symmetric call to typec_deattach() that connector_bind() makes via:

if (port_dev->child)

typec_attach(port_dev->connector, &port_dev->child->dev);

When a Thunderbolt dock is unplugged, two teardown paths race:

1. The component framework calls connector_unbind() first, which sets

port_dev->connector = NULL without calling typec_deattach(). This

leaves port->usb2_dev/port->usb3_dev in struct typec_port pointing at

the USB device that is about to be freed.

2. usb_disconnect() then calls typec_deattach(port_dev->connector, ...),

but port_dev->connector is already NULL, so the call is a no-op and

port->usb2_dev is never cleared.

3. Concurrently, UCSI detects a PD partner-disconnect event and calls

typec_unregister_partner(), which reads port->usb2_de

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References