CVE-2026-74441
N/A ALL-YEARSIn the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix race condition and ordering in port unregistration A synchronization issue exists during port unregistration where pending partner work items can race against workqueue destruction, leading to use-after-free conditions: cros_ec_ucsi cros_ec_ucsi.3.auto: error -ETIMEDOUT: PPM init failed BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:__queue_work+0x83/0x4a0 Call Trace: <IRQ> __cfi_delayed_work_timer_fn+0x10/0x10 run_timer_softirq+0x3b6/0xbd0 sched_clock_cpu+0xc/0x110 irq_exit_rcu+0x18d/0x330 fred_sysvec_apic_timer_interrupt+0x5e/0x80 Fix this by ensuring strict ordering and proper serialization during teardown: 1. Move ucsi_unregister_partner() to the beginning of the teardown sequence and protect it under the connector mutex lock. 2. Ensure all pending partner tasks are explicitly flushed and finished before the workqueue is destroyed. 3. Switch from mod_delayed_work() to a cancel_delayed_work() and queue_delayed_work() sequence. This guarantees that items currently marked as pending won't be scheduled an additional time, preventing a double release of resources which leads to the following crash: Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP NOPTI Workqueue: cros_ec_ucsi.3.auto-con2 ucsi_poll_worker RIP: 0010:ucsi_poll_worker+0x65/0x1e0 Call Trace: <TASK>
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 7th percentile
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
References and research data (JSON)
Vendor product assessments
Showing 32 of 274 vendor product statements; 242 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- none available: Affected
kernel-abi-stablelists as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-abi-stablelists
- none available: Affected
kernel-modules-extra-matched as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules-extra-matched
- none available: Affected
kernel-rt-debug as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug
- none available: Affected
kernel-uki-virt-addons as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-uki-virt-addons
- none available: Affected
kernel as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- none available: Affected
kernel-modules as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules
- none available: Affected
kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules-internal
- none available: Affected
python3-perf as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/python3-perf
- none available: Affected
kernel-64k-modules as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-modules
- none available: Affected
kernel-debug-modules-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-modules-internal
- none available: Affected
kernel-rt-64k as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k
- none available: Affected
kernel-rt-64k-modules-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-modules-core
- none available: Affected
kernel-rt-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-devel
- none available: Affected
kernel-zfcpdump as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump
- none available: Affected
rv as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/rv
- none available: Affected
kernel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-debug as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-devel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-devel
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-headers as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-headers
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel.src as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00bpftool as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/bpftool
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-abi-whitelists as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-abi-whitelists
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-debug-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-devel
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-headers as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-headers
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-rt as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-devel
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-doc
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-rt-trace-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-trace-devel
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-tools as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools-libs-devel
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00python-perf as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python-perf
Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74441.json Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59748 EUVD · EUVD-2026-59748
Technical & other
- https://git.kernel.org/stable/c/7b63c680ff605f60f056e5f2c323f1a602aee182CVE record · Linux · Updated 2026-08-23T12:47:17.900Z
NVD · CVE-2026-74441 · Updated 2026-08-23T13:16:43.717 - https://git.kernel.org/stable/c/07f8aaffee705e552c1f723ac8bf7eb137ad59c2CVE record · Linux · Updated 2026-08-23T12:47:17.900Z
NVD · CVE-2026-74441 · Updated 2026-08-23T13:16:43.717 - https://git.kernel.org/stable/c/11483d80267db97fbe49f2df66385434256cc3b0CVE record · Linux · Updated 2026-08-23T12:47:17.900Z
NVD · CVE-2026-74441 · Updated 2026-08-23T13:16:43.717 - https://git.kernel.org/stable/c/3f7b3728dd9011c915cbeaea77274ebe8366550dCVE record · Linux · Updated 2026-08-23T12:47:17.900Z
NVD · CVE-2026-74441 · Updated 2026-08-23T13:16:43.717 - https://git.kernel.org/stable/c/bc7a0f721123ea260a42f1ded06dab844ba49434CVE record · Linux · Updated 2026-08-23T12:47:17.900Z
NVD · CVE-2026-74441 · Updated 2026-08-23T13:16:43.717 - https://git.kernel.org/stable/c/7aa7d4bf9d3fa9a6a47b640ad103ab433b7ff261CVE record · Linux · Updated 2026-08-23T12:47:17.900Z
NVD · CVE-2026-74441 · Updated 2026-08-23T13:16:43.717 - https://access.redhat.com/security/cve/CVE-2026-74441 Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2516993 Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-74441 Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-74441 Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00
- https://lore.kernel.org/linux-cve-announce/2026081529-CVE-2026-74441-d92e@gregkh/T Red Hat · CVE-2026-74441 · Updated 2026-08-21T09:56:09+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS