CVE-2026-90028 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: hd3ss3220: track VBUS enable state per consumer
regulator_is_enabled() reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can skip its own regulator_enable() call and later attempt to drop a reference it never acquired, triggering an unbalanced regulator disable warning.
Track successful enable and disable calls locally. Keep the state unchanged when an operation fails so a later role or ID notification retries the operation while this consumer keeps balanced references.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's USB Type-C HD3SS3220 driver stems from a fundamental misunderstanding of how regulator reference counting operates within the kernel power management subsystem. The core technical flaw lies in the driver's reliance on the regulator_is_enabled function to determine whether it should invoke regulator_enable or regulator_disable for VBUS power delivery. This API returns the aggregate state of the regulator, indicating if any consumer has enabled it, rather than reflecting whether the specific calling entity holds an active reference count. In a multi-consumer environment where multiple drivers may request access to the same voltage rail, this distinction is critical. If another driver successfully enables VBUS before the HD3SS3220 driver attempts its own enable sequence, regulator_is_enabled will return true. Consequently, the flawed logic causes the HD3SS3220 driver to skip calling regulator_enable, thereby failing to acquire a reference count for that specific consumer instance.
This logical error leads directly to an unbalanced regulator disable warning when the system later attempts to shut down or change roles. When the HD3SS3220 driver eventually needs to disable VBUS, it proceeds to call regulator_disable based on its internal state assumptions without having previously incremented the reference count via a successful enable call. The kernel's regulator core detects this discrepancy because the number of disables exceeds the number of enables for that specific consumer context. This results in an unbalanced reference warning being logged and potentially causes instability or premature power rail shutdown if the underlying implementation does not strictly enforce reference counting integrity, although modern kernels typically just warn to alert developers of such logic errors. The issue is classified under CWE-691 as Use of Less Than Intended Control Flow because the software fails to properly manage control flow regarding resource acquisition and release due to incorrect state checking.
The operational impact of this vulnerability includes kernel log spam which can obscure other critical security or stability warnings, potential race conditions during role swaps where power states are not correctly maintained for all consumers, and in severe cases, system instability if the regulator framework's error handling mechanisms trigger unexpected behaviors. The flaw specifically affects scenarios involving USB Type-C Alternate Modes or Power Delivery negotiations where VBUS state changes frequently based on connection events, cable orientation, or host-device role switching. By tracking successful enable and disable calls locally rather than relying solely on the global regulator state, the driver ensures that reference counts remain balanced regardless of which consumer initiated the power change first. This local state tracking allows the driver to retry operations if they fail initially while maintaining accurate accounting for subsequent disables.
To mitigate this vulnerability, developers must modify the HD3SS3220 driver implementation to maintain a private boolean or integer variable that tracks whether regulator_enable was successfully called by this specific consumer instance. Before calling regulator_disable, the code should check this local state rather than querying the global regulator status. This ensures that disable is only invoked when an enable has previously succeeded for that context. Furthermore, error handling paths must be reviewed to ensure that if regulator_enable fails, no reference count is assumed to have been acquired, preventing future unbalanced disables. From a broader security perspective, this aligns with ATT&CK technique T1496 Resource Hijacking as improper resource management can lead to denial of service conditions through system instability or log flooding which degrades operational visibility for security monitoring teams. Ensuring strict adherence to reference counting protocols in kernel drivers is essential for maintaining the integrity and reliability of power delivery systems in modern computing devices.