A synchronization issue exists during port unregistration in the Linux kernel’s USB‑TypeC UCSI subsystem. The race condition can cause a use‑after‑free when pending partner work items collide with workqueue destruction, leading to a kernel crash. This flaw reflects an improper ordering/synchronization defect (CWE‑825).

All installations of the Linux kernel that include the UCSI port teardown code are affected. The vulnerability applies to any kernel build that retains the old unregistration sequence before the ucsi_unregister_port() helper was introduced, regardless of the specific version, as the issue stems from the core teardown logic.

The vulnerability carries a high severity, with a CVSS score of 7.0. Exploitation requires the ability to trigger a port unregistration while work items are queued, which may be achieved by a malicious USB‑TypeC device or a local privileged process. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local or through a connected USB‑TypeC device, and the vulnerability poses a memory safety violation that can lead to a kernel crash.