CVE-2026-64463 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns without unregistering the TCPCI port. The explicit unregister currently only happens from the remove callback.
Register a devres action immediately after tcpci_register_port() succeeds, so tcpci_unregister_port() runs on later probe failures and on driver detach. Drop the remove callback to avoid unregistering the same port twice.
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability in question affects the Linux kernel's USB Type-C implementation specifically within the tcpci_rt1711h driver which manages the Realtek rt1711h Type-C controller. This represents a resource management flaw that can lead to improper device state handling and potential system instability. The issue stems from the probe function's failure to properly clean up registered TCPCI ports when subsequent initialization steps encounter errors, creating a scenario where device resources remain allocated but in an inconsistent state.
The technical flaw occurs during the driver's probe phase where rt1711h_probe() first registers the TCPCI port using tcpci_register_port() before proceeding to request interrupts and enable alert interrupts. When either of these later steps fails due to hardware issues, interrupt configuration problems, or other initialization errors, the function returns prematurely without calling the necessary cleanup routine tcpci_unregister_port(). This creates a memory leak scenario where the port registration remains active but the underlying hardware resources may be in an undefined state, potentially causing conflicts during subsequent driver operations or system reboots.
From an operational perspective this vulnerability can manifest as system instability, device driver crashes, or failure to properly initialize Type-C ports for charging or data transfer operations. The impact extends beyond simple resource leaks since the improperly managed port state could interfere with concurrent USB operations or prevent proper device enumeration. This type of issue is particularly concerning in embedded systems or mobile devices where Type-C ports handle critical power delivery and data communication functions, as it could lead to complete loss of USB-C functionality or unexpected system behavior during power management transitions.
The fix implements a devres (device resource) action immediately after successful tcpci_register_port() completion, ensuring that tcpci_unregister_port() is automatically called whenever the probe function exits, whether successfully or due to failure. This approach leverages Linux kernel's device resource management framework to provide automatic cleanup semantics and eliminates the need for manual cleanup in error paths while also removing the redundant remove callback that could cause double-unregistration issues. This solution aligns with common security practices for preventing resource leaks and follows established kernel development patterns for proper resource lifecycle management.
The vulnerability maps directly to CWE-404, which addresses improper resource release or unmanagement, and exhibits characteristics similar to CWE-704, indicating improper handling of device state transitions. From an ATT&CK perspective this issue relates to T1547.001 (Registry Run Keys / Startup Folder) through potential driver initialization failures that could affect system boot processes or power management services, though the direct impact is more focused on device driver resource management rather than persistence mechanisms.
This fix demonstrates proper defensive programming practices in kernel development where automatic resource cleanup through device resource management prevents scenarios where manual error handling might be forgotten or misimplemented. The approach provides robustness against partial initialization failures and ensures consistent state management throughout the driver's lifecycle, addressing both immediate stability concerns and long-term system reliability requirements for USB Type-C implementations in Linux systems.