CVE-2026-98761

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: recover after failure to start the frs ams

Reset the port if the tcpm fails to start the FAST_ROLE_SWAP AMS by

initiating error recovery on it.

This helps in cases where some cables (incorrectly) signal an FRS to

an FRS capable port during disconnection. The TCPC autonomously starts

sourcing VBUS on detecting the FRS signal. However, the VBUS sourcing is

left on when the FAST_ROLE_SWAP AMS fails to start (as tcpm_sink_tx_ok

is 0 as CC is open due to the cable disconnect). This is because the

code sets the state to INVALID_STATE without resetting the port state.

Log snippet before changes:

[ 101.401960] AMS FAST_ROLE_SWAP start

[ 101.401971] Sink TX No Go

[ 101.401982] sourcing vbus

[ 101.401987] VBUS on

[ 101.402159] VBUS on

[ 109.257809] CC1: 0 -> 0, CC2: 5 -> 0 [state SNK_READY, polarity 1, disconnected]

[ 111.267442] VBUS on

After changes:

[ 70.541211] AMS FAST_ROLE_SWAP start

[ 70.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References