CVE-2026-98768
Description
A flaw was found in the Linux kernel's ANX7411 USB Type-C driver. This flaw allows a Denial of Service (DoS) due to a race condition during device removal. Because an interrupt request (IRQ) remains active while the driver destroys its work queue, an incoming interrupt during teardown can trigger a system crash.
Statement
A lifecycle race in the anx7411 Type C driver allows the devm managed IRQ to queue plat work while anx7411_i2c_remove() is cancelling work and destroying the associated workqueue. A late interrupt can therefore submit work through a stale workqueue pointer, creating a potential use-after-free that may corrupt workqueue state or crash the kernel. Reliable triggering requires an IRQ to occur inside the narrow driver teardown window, so the attack complexity is high. For the CVSS the PR:L value is used for the paranoid score because a locally constrained user may be able to influence Type C activity or operate through delegated device management while teardown is initiated by another system component. The normal administrative unbind path instead supports PR:H for the base score. The issue is not network reachable, although a connected Type C or USB PD device may influence interrupt timing. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to potential use-after-free memory corruption.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
