In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

The pmic glink client is released by the devres cleanup, which runs after pmic glink ucsi remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi unregister() has been called touches freed state: it dereferences the connector array that ucsi unregister() freed, or registers and unregisters the instance a second time.

Disable both work items with disable work sync() before unregistering, and unregister only if the instance is still registered.

This issue was found by an in-house static analysis tool.