CVE-2026-64329

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the USB Type-C UCSI CCG driver. The threaded IRQ handler ccg irq handler() invokes ucsi notify common(), which may trigger ucsi connector change() and schedule connector work. During the removal process in ucsi ccg remove(), the ucsi destroy() function frees the uc->ucsi object before free irq() is called. This sequence allows a handler invocation already in progress to access the freed memory object.

Recommendations In the remove path, move the free irq() call to occur before ucsi destroy() to ensure the interrupt handler is disabled before the object is freed.