Linux Kernel Vulnerability Affecting USB Type-C Functionality

CVE-2026-90027

What is CVE-2026-90027?

A vulnerability in the Linux Kernel's USB Type-C implementation allows delayed work callbacks to run after cleanup operations, potentially causing device management issues. Specifically, when the port is stopped, queued callbacks may execute after resources have been freed, leading to unstable behavior. A fix has been implemented by disabling delayed work synchronization during the port stop process to ensure callbacks do not interfere with the cleanup of the type-C port.

References