The flaw occurs in the Linux kernel USB Type‑C driver when a partnership registration fails; the code reports the error but continues to use the returned pointer, which may contain an error value. Dereferencing this value can cause the kernel to crash, resulting in a denial‑of‑service condition. The vulnerability does not provide a direct path to code execution, but a kernel panic could be leveraged by a privileged adversary to compromise the system. The defect was identified by the Smatch static analyzer and confirmed by a specific commit sequence that fixed the missing early return and corrected a typo in the warning message.

All Linux kernel builds that include the USB Type‑C driver with a partner registration routine are affected. No specific kernel version range is listed; the issue exists in any release that contains the buggy code before the documented commits. Updating to a kernel version incorporating the fixes from the referenced commits or newer kernels should eliminate the problem.

The vulnerability requires physical access to a USB Type‑C device that triggers a partner registration failure. Attack complexity is low, and local access is sufficient. The exploitation likelihood is uncertain due to lack of EPSS data, but the impact of a kernel crash is high. Although the CVSS score is not stated, the potential for a DoS scenario places this flaw in a moderate‑to‑high risk category. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.