An uninitialized kernel data structure, typec_partner_desc, was passed to typec_register_partner without fully initializing its fields. This left function pointer members and other callbacks containing garbage stack data. When a USB device is later linked to the Type‑C port, the driver may invoke these uninitialized pointers, potentially executing arbitrary kernel code or leaking sensitive stack information through sysfs. The flaw thus enables a local attacker to gain kernel‑level execution or info‑leak capabilities.

All Linux kernel builds that contain the cd321x driver before the patch – i.e. any release that did not include the commit that zero‑initializes typec_partner_desc – are susceptible. The issue was fixed in the kernel by ensuring all descriptor fields are set to zero before registration.

Based on the description, it is inferred that the flaw is triggered only when a USB device is physically connected to the system, indicating a local attack vector that requires physical or trusted USB access. The CVSS score is 6.8. The EPSS score indicates a low exploitation probability of less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no documented exploits yet, but the severity of the bug warrants caution.