A synchronization problem in the Linux kernel’s USB‑TypeC UCSI subsystem exposes a race condition during port unregistration. When a partner work item is still pending while the associated workqueue is destroyed, a use‑after‑free occurs, causing a kernel crash. This memory corruption can bring the entire system down and, if triggered in a privileged context, may be leveraged for privilege escalation. The flaw reflects a classic Use‑After‑Free weakness (CWE‑416).

All Linux kernel installations that include the UCSI port teardown code are affected. No specific version range is specified in the data; the issue applies to any kernel build that retains the old unregistration sequence before the ucsi_unregister_port() helper was added.

The vulnerability carries a high severity. While no CVSS score is supplied, the nature of the flaw (kernel memory corruption) implies a critical impact. Exploitation requires the ability to trigger a port unregistration while work items are queued, typically through a malicious USB‑TypeC device or local privileged process. EPSS data is absent and the flaw is not listed in CISA’s KEV catalog, but the lack of public exploits does not reduce the risk posed by the underlying memory safety violation.