CVE-2026-68372

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the USB core port handling where the connector unbind() function fails to call typec deattach(), creating an asymmetry with the connector bind() function. When a Thunderbolt dock is unplugged, a race condition occurs between the component framework and the USB disconnect process. Specifically, connector unbind() sets port dev->connector to NULL without detaching the type-C connector, leaving dangling pointers in port->usb2 dev or port->usb3 dev within the typec port structure.

Concurrently, if UCSI (USB Type-C Connector System Software Interface) detects a partner-disconnect event, it calls typec unregister partner(), which may dereference these dangling pointers. This can lead to memory corruption, inconsistent Thunderbolt tunnel states, or a use-after-free condition where the system attempts to access memory that has already been freed. This may result in hardware enumeration failures, such as the I225/igc NIC failing to initialize.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.