CVE-2026-98761 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: recover after failure to start the frs ams
Reset the port if the tcpm fails to start the FAST_ROLE_SWAP AMS by initiating error recovery on it.
This helps in cases where some cables (incorrectly) signal an FRS to an FRS capable port during disconnection. The TCPC autonomously starts sourcing VBUS on detecting the FRS signal. However, the VBUS sourcing is left on when the FAST_ROLE_SWAP AMS fails to start (as tcpm_sink_tx_ok is 0 as CC is open due to the cable disconnect). This is because the code sets the state to INVALID_STATE without resetting the port state.
Log snippet before changes: [ 101.401960] AMS FAST_ROLE_SWAP start
[ 101.401971] Sink TX No Go
[ 101.401982] sourcing vbus
[ 101.401987] VBUS on
[ 101.402159] VBUS on
[ 109.257809] CC1: 0 -> 0, CC2: 5 -> 0 [state SNK_READY, polarity 1, disconnected]
[ 111.267442] VBUS on
After changes: [ 70.541211] AMS FAST_ROLE_SWAP start
[ 70.541220] Sink TX No Go
[ 70.541228] state change SNK_READY -> ERROR_RECOVERY [rev3 NONE_AMS]
[ 70.541362] VBUS on
[ 70.541365] sourcing vbus
[ 70.541367] VBUS on
[ 70.541374] state change ERROR_RECOVERY -> PORT_RESET [rev3 NONE_AMS]
[ 70.541410] disable vbus discharge ret:0
[ 70.543028] Setting usb_comm capable false
[ 70.544009] Setting voltage/current limit 0 mV 0 mA
[ 70.544034] polarity 0
[ 70.544239] Requesting mux state 0, usb-role 0, orientation 0
[ 70.555550] cc:=0
[ 70.555595] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS]
[ 70.555697] VBUS off
[ 70.555702] VBUS VSAFE0V
[ 70.555762] CC1: 5 -> 0, CC2: 0 -> 0 [state PORT_RESET, polarity 0, disconnected]
[ 70.587794] VBUS off
[ 70.587799] VBUS VSAFE0V
[ 70.655672] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms]
[ 70.655682] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [rev3 NONE_AMS]
[ 70.655686] Start toggling
[ 70.656274] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel USB Type-C Port Manager contains a logic flaw in the handling of Fast Role Swap operations that can lead to persistent power delivery states and potential hardware damage. This vulnerability arises when the TCPM fails to initiate the Fast Role Swap Alternate Mode State Machine due to an open CC line, typically caused by cable disconnection during the handshake process. In such scenarios, the Type-C Port Controller Module may autonomously begin sourcing VBUS voltage upon detecting a signal intended for role swapping. However, because the communication channel is physically broken or invalid at that moment, the TCPM cannot complete the transmission and returns an error status indicating that sink transmission is not possible.
Prior to this fix, when the Fast Role Swap AMS failed to start under these conditions, the code incorrectly transitioned the port state directly to INVALID_STATE without performing a full hardware reset. This oversight left the VBUS sourcing enabled indefinitely because the logic did not trigger the necessary cleanup routines to disable power output or reinitialize the port configuration. Consequently, if an incorrect cable signaled a Fast Role Swap during disconnection, the host device would continue supplying high voltage on the USB-C connector even after the peripheral was removed. This state persists until the system is manually reset or powered off, creating a risk of electrical damage to connected devices that might still be partially attached or sensitive to unexpected power presence.
The operational impact of this vulnerability includes potential hardware failure for downstream peripherals and inefficient battery drain on mobile devices acting as hosts. By leaving VBUS active in an undefined state, the system violates safe operating conditions defined by USB Type-C specifications. This can lead to overheating, component stress, or permanent damage to sensitive electronics that rely on proper power negotiation before accepting current from a source. Furthermore, it disrupts normal enumeration processes and may cause confusion for subsequent connection attempts as the port remains in an erroneous state rather than returning to a neutral disconnected status.
The resolution involves modifying the tcpm code to detect when the Fast Role Swap AMS fails to start due to transmission errors or open CC lines. Upon detecting such a failure, the system now explicitly initiates error recovery procedures that transition the port through ERROR_RECOVERY and PORT_RESET states. This sequence ensures that VBUS is disabled, voltage and current limits are reset to zero, polarity settings are cleared, and mux configurations are reverted to default values. The port then proceeds through standard disconnection protocols including toggling on the CC lines to properly detect attachment status changes.
This fix aligns with industry standards for robust state machine management in USB Type-C controllers. It addresses weaknesses related to improper resource cleanup after failed operations, which can be categorized under CWE-401 Missing Release of Resource after Effective Lifetime or CWE-252 Unchecked Return Value if considering the initial failure check. From a security and reliability perspective, it mitigates risks associated with physical layer manipulation where an attacker could potentially exploit cable signaling to keep power lines active for malicious purposes such as data exfiltration via powered channels or hardware damage attacks. The ATT&CK framework does not directly map this specific kernel bug but relates to techniques involving peripheral device compromise or supply chain vulnerabilities if exploited in conjunction with other flaws.
To mitigate similar issues, developers should ensure that all state transitions resulting from failed AMS operations include comprehensive cleanup routines that reset both software states and hardware configurations. Regular auditing of Type-C port manager logic against USB PD specifications is recommended to identify edge cases where power delivery might remain active during error conditions. System administrators can monitor kernel logs for repeated FAST_ROLE_SWAP failures or unexpected VBUS activity as indicators of this vulnerability being triggered in production environments until patches are applied.