CVE-2026-93225
📛 CVE Title
phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
Description
In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95_usb_phy_get_tca() succeeds, the typec switch leaks because the only cleanup path was in .remove(), which never runs on probe failure. Use devm_add_action_or_reset() so the switch is cleaned up on both probe failure and driver removal. The imx95_usb_phy_put_tca() is no longer needed, it will be removed in .remove() too.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Linux
- CVSS severity
- HIGH
- CVSS score
- 7.4 / 10
- CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 7.4 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- 2026-09-17
- Published
- 2026-09-24 15:21 UTC
- Last updated
- 2026-09-25 05:09 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93225.json
- Linked Threat
- CVE-2026-93225 — phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-24 16:17:17 UTC
- NVD last modified
- 2026-09-24 16:17:17 UTC
NVD / KEV / EPSS data refreshed 2026-09-25 04:32 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-86228 - Assigner
- Linux
- Published
- Sep 24, 2026, 3:21:12 PM
- Updated
- Sep 25, 2026, 5:09:46 AM
- EUVD base score (CVSS 3.1)
-
7.4 / 10
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.0000
- Vendors
- Linux
- Products
-
Linux (patch: 7.3-rc1)Linux (6.15)Linux (patch: 6.18.50)Linux (b58f0f86fd6156d7b084257f5c91ceaf7d760927 <87a1805b1c346b092c34f96f3806f207792910e1)Linux (b58f0f86fd6156d7b084257f5c91ceaf7d760927 <84646f5b945a370f6999eed59a334387b0abc282)Linux (patch: 0)Linux (b58f0f86fd6156d7b084257f5c91ceaf7d760927 <f1b7b2c7ffa9711d1298f52790b377fe02efc1db)Linux (patch: 7.2.4)
- Aliases
-
GHSA-x24p-xpmf-j8m7
ENISA description: In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95_usb_phy_get_tca() succeeds, the typec switch leaks because the only cleanup path was in .remove(), which never runs on probe failure. Use devm_add_action_or_reset() so the switch is cleaned up on both probe failure and driver removal. The imx95_usb_phy_put_tca() is no longer needed, it will be removed in .remove() too.
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Linux | Linux |
b58f0f86fd6156d7b084257f5c91ceaf7d760927 (affected),
b58f0f86fd6156d7b084257f5c91ceaf7d760927 (affected),
b58f0f86fd6156d7b084257f5c91ceaf7d760927 (affected)
|
— |
| Linux | Linux |
6.15 (affected),
0 (unaffected),
6.18.50 (unaffected),
7.2.4 (unaffected),
7.3-rc1 (unaffected)
|
— |
Vendor references (3)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://git.kernel.org/stable/c/84646f5b945a370f6999eed59a334387b0abc282 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/87a1805b1c346b092c34f96f3806f207792910e1 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/f1b7b2c7ffa9711d1298f52790b377fe02efc1db 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remediations (16)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:anonhaven.com
CVE Details CVE ID CVE-2026-93225 Published Date Sep 24, 2026 Vendor Linux Severity NONE Impact Minimal impact Source View Advisory
2026-09-25 10:45 UTC -
web:blogs.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-25 10:45 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-09-25 10:45 UTC -
web:cvetodo.com
CVE-2026-93225 vulnerability details and analysis. Full technical analysis, mitigations , and exploit status — updated in real time.
2026-09-25 10:45 UTC -
web:labs.cloudsecurityalliance.org
All three Linux kernel vulnerabilities received that compressed timeline: CISA published the KEV additions on September 18 and set the remediation deadline for September 21, a three-day window that BOD 26-04's risk matrix assigns when a vulnerability is publicly exploited, has an automatable exploit, and produces total control impact, criteria ...
2026-09-25 10:45 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-09-25 10:45 UTC -
web:patchmypc.com
You can find the production release history below for 2026 .
2026-09-25 10:45 UTC -
web:threat-intelligence.redeyesecurity.com
CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog on September 19, 2026 , with a federal patch deadline of September 21. Red Hat confirmed public exploit code exists for all three. The bugs hit the kTLS receive path, the ebtables SNAT ARP rewrite path, and AF_ALG crypto sockets.
2026-09-25 10:45 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-25 10:45 UTC -
web:www.oracle.com
Additional CVEs addressed are: The patch for CVE - 2026 -34481 also addresses CVE - 2026 -34477, CVE - 2026 -34478, CVE - 2026 -34479, and CVE - 2026 -34480. Oracle Fusion Middleware Risk Matrix This Critical Security Patch Update contains 106 new security patches for Oracle Fusion Middleware. 53 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a ...
2026-09-25 10:45 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-09-25 15:07 UTC -
web:sec.cloudapps.cisco.com
On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...
2026-09-25 15:07 UTC -
web:support.sap.com
SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape. On 9th of June 2026 , SAP security patch day saw the release of 15 new security notes.
2026-09-25 15:07 UTC -
web:www.aikido.dev
CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.
2026-09-25 15:07 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-09-25 15:07 UTC -
web:www.techtimes.com
BIND 9.20.26 patches nine CVEs , including a remote code execution flaw in DNS-over-HTTPS, as ISC confirms LLM-assisted auditing has driven vulnerability report rates more than ten times above ...
2026-09-25 15:07 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-93225.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/phy/freescale/phy-fsl-imx8mq-usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f1b7b2c7ffa9711d1298f52790b377fe02efc1db",
"status": "affected",
"version": "b58f0f86fd6156d7b084257f5c91ceaf7d760927",
"versionType": "git"
},
{
"lessThan": "84646f5b945a370f6999eed59a334387b0abc282",
"status": "affected",
"version": "b58f0f86fd6156d7b084257f5c91ceaf7d760927",
"versionType": "git"
},
{
"lessThan": "87a1805b1c346b092c34f96f3806f207792910e1",
"status": "affected",
"version": "b58f0f86fd6156d7b084257f5c91ceaf7d760927",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/phy/freescale/phy-fsl-imx8mq-usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: fsl-imx8mq-usb: fix typec switch leak on probe error path\n\nIf probe fails after imx95_usb_phy_get_tca() succeeds, the typec\nswitch leaks because the only cleanup path was in .remove(), which\nnever runs on probe failure.\n\nUse devm_add_action_or_reset() so the switch is cleaned up on both\nprobe failure and driver removal. The imx95_usb_phy_put_tca() is no\nlonger needed, it will be removed in .remove() too."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The leak is created in imx8mq_usb_phy_probe() after tca_blk_get_typec_switch() calls typec_switch_register(); the entry point is platform_probe of DT node usb3_phy@4c1f0040 (compatible fsl,imx95-usb-phy). No USB or network protocol message carries the trigger; this is a probe error-path leak.\nAC:H - After imx95_usb_phy_get_tca() succeeds, the only later failure is ENOMEM from kzalloc/devres_alloc in __devm_of_phy_provider_register(); imx8m_get_phy_tuning_data() cannot fail. That GFP_KERNEL failure is not attacker-controlled, and suppress_bind_attrs=true blocks sysfs rebind of imx8mq-usb-phy.\nPR:N - imx8mq_usb_phy_probe() has no capable() check. PHY_FSL_IMX8MQ_USB defaults y on ARCH_MXC&&ARM64, so of_platform populate binds usb3_phy@4c1f0040 during kernel init on i.MX95 boards that set status=okay. Sysfs bind is not required and is disabled by suppress_bind_attrs.\nUI:N - of_platform probe of usb3_phy and a later tcpci/tcpm_register_port() of ptn5110@50 (imx95-19x19-evk typec_con) run unattended at boot. typec_register_port() calls typec_switch_get() without a mount, open, or USB-C cable plug.\nS:U - The leaked typec_switch_dev, the devres free of imx8mq_usb_phy, and tca_blk_typec_switch_set() run in the host kernel PHY/Type-C stack. This is not a KVM/Xen guest-to-host escape or an IOMMU/DMA bypass.\nC:H - typec_switch_register() stores drvdata=imx_phy; probe failure then frees that imx8mq_usb_phy via devres while the class device remains. tca_blk_typec_switch_set() reads the freed object via typec_switch_get_drvdata() when TCPM's tcpm_mux_set() calls typec_set_orientation().\nI:H - The same dangling drvdata is used by tca_blk_typec_switch_set() to clk_prepare_enable(imx_phy->clk) and by tca_blk_orientation_set() to writel() TCA_GCFG/TCA_SYSMODE_CFG through tca->base; reclaiming the freed imx8mq_usb_phy/tca_blk slab is a write and control-flow primitive.\nA:H - Once probe fails, fwnode_typec_switch_get() does try_module_get(sw_dev->dev.parent->driver->owner) with parent->driver NULL, or tca_blk_typec_switch_set() dereferences the freed imx_phy; either path oopses the i.MX95 host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T05:09:46.847Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f1b7b2c7ffa9711d1298f52790b377fe02efc1db"
},
{
"url": "https://git.kernel.org/stable/c/84646f5b945a370f6999eed59a334387b0abc282"
},
{
"url": "https://git.kernel.org/stable/c/87a1805b1c346b092c34f96f3806f207792910e1"
}
],
"title": "phy: fsl-imx8mq-usb: fix typec switch leak on probe error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93225",
"datePublished": "2026-09-24T15:21:12.635Z",
"dateReserved": "2026-09-17T16:02:15.094Z",
"dateUpdated": "2026-09-25T05:09:46.847Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}