Skip to main content
← All vulnerabilities
CVE-2026-90028

usb: typec: hd3ss3220: track VBUS enable state per consumer

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 7.2.5
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulator_is_enabled() reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can skip its own regulator_enable() call and later attempt to drop a reference it never acquired, triggering an unbalanced regulator disable warning. Track successful enable and disable calls locally. Keep the state unchanged when an operation fails so a later role or ID notification retries the operation while this consumer keeps balanced references.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From b3f9d6e491fda73c319547881b78cdd2a222b293 · fixed in df7cd3908e07503fa7e9737dacf44208530e58d9; From b3f9d6e491fda73c319547881b78cdd2a222b293 · fixed in c9a48db776d7184981630ecc01a3ad30a8f7dc24

  • Linux Linux

    7.0

  • KernelLinux

    From 7.0.0 · fixed in 7.2.5

References 2

git.kernel.org