CVE-2026-98761 - Vulnerability Details

- usb: typec: tcpm: recover after failure to start the frs ams

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: recover after failure to start the frs ams

Reset the port if the tcpm fails to start the FAST_ROLE_SWAP AMS by
initiating error recovery on it.

This helps in cases where some cables (incorrectly) signal an FRS to
an FRS capable port during disconnection. The TCPC autonomously starts
sourcing VBUS on detecting the FRS signal. However, the VBUS sourcing is
left on when the FAST_ROLE_SWAP AMS fails to start (as tcpm_sink_tx_ok
is 0 as CC is open due to the cable disconnect). This is because the
code sets the state to INVALID_STATE without resetting the port state.

Log snippet before changes:
[ 101.401960] AMS FAST_ROLE_SWAP start
[ 101.401971] Sink TX No Go
[ 101.401982] sourcing vbus
[ 101.401987] VBUS on
[ 101.402159] VBUS on
[ 109.257809] CC1: 0 -> 0, CC2: 5 -> 0 [state SNK_READY, polarity 1, disconnected]
[ 111.267442] VBUS on

After changes:
[ 70.541211] AMS FAST_ROLE_SWAP start
[ 70.541220] Sink TX No Go
[ 70.541228] state change SNK_READY -> ERROR_RECOVERY [rev3 NONE_AMS]
[ 70.541362] VBUS on
[ 70.541365] sourcing vbus
[ 70.541367] VBUS on
[ 70.541374] state change ERROR_RECOVERY -> PORT_RESET [rev3 NONE_AMS]
[ 70.541410] disable vbus discharge ret:0
[ 70.543028] Setting usb_comm capable false
[ 70.544009] Setting voltage/current limit 0 mV 0 mA
[ 70.544034] polarity 0
[ 70.544239] Requesting mux state 0, usb-role 0, orientation 0
[ 70.555550] cc:=0
[ 70.555595] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS]
[ 70.555697] VBUS off
[ 70.555702] VBUS VSAFE0V
[ 70.555762] CC1: 5 -> 0, CC2: 0 -> 0 [state PORT_RESET, polarity 0, disconnected]
[ 70.587794] VBUS off
[ 70.587799] VBUS VSAFE0V
[ 70.655672] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms]
[ 70.655682] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [rev3 NONE_AMS]
[ 70.655686] Start toggling
[ 70.656274] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]

Published: 2026-10-18

Score: 4.0 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel the TCPC driver does not reset the port when a Fast Role Swap Alternate Mode (FRS AMS) attempt fails. The failure leaves the port in an INVALID_STATE and the device continues to source VBUS even after the cable is disconnected, delivering unintended power to the connected device and potentially causing erratic USB behavior.

Affected Systems

The bug affects any Linux kernel build that has not yet incorporated the error‑recovery patch referenced in the advisory. All users running a kernel prior to the commits adding the recovery logic, regardless of distribution, are potentially impacted.

Risk and Exploitability

The CVSS score of 4.0 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of public exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require physically connecting a USB Type‑C cable that incorrectly signals an FRS during a disconnect event. Because the flaw is hardware‑dependent and no public exploits are known, the risk of exploitation in typical environments remains low, albeit the failure could leave the port in an unusable state.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0908c5aca31eb5e0c72d7a5dba422629b88e877d`	affected	< b321eaa21555889aa42c4b45627f544565dc82c1
`0908c5aca31eb5e0c72d7a5dba422629b88e877d`	affected	< 7a7d9df0b82fbb40e70394b67a06670b9516ff94
`0908c5aca31eb5e0c72d7a5dba422629b88e877d`	affected	< ae8aae45a39fcf2c64813652fcb062eace220712
`0908c5aca31eb5e0c72d7a5dba422629b88e877d`	affected	< 184d842121e7d1fbc3a81895f36f72fa27444163
`0908c5aca31eb5e0c72d7a5dba422629b88e877d`	affected	< b2ed8643face247e513fad12e193378ba67a61a1
`0908c5aca31eb5e0c72d7a5dba422629b88e877d`	affected	< d6b0cce612636f79f2cf0652fce40a0cbff7f0ed
`0908c5aca31eb5e0c72d7a5dba422629b88e877d`	affected	< 90156585765b29304f07b0e4a1c56a969876fcfc

Linux

affected

Version	Status	Constraints
`5.12`	affected	—
`0`	unaffected	< 5.12
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0908c5aca31eb5e0c72d7a5dba422629b88e877d,184d842121e7d1fbc3a81895f36f72fa27444163)`	affected	code_commit	—
`[0908c5aca31eb5e0c72d7a5dba422629b88e877d,b2ed8643face247e513fad12e193378ba67a61a1)`	affected	code_commit	—
`[0908c5aca31eb5e0c72d7a5dba422629b88e877d,d6b0cce612636f79f2cf0652fce40a0cbff7f0ed)`	affected	code_commit	—
`[0908c5aca31eb5e0c72d7a5dba422629b88e877d,90156585765b29304f07b0e4a1c56a969876fcfc)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.12`	affected	generic	—
`[0,5.12)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the tcpm error‑recovery patch for failed FRS AMS start failures
Disable or avoid using Fast Role Swap (FRS) capable cables or ports if an update is not feasible
Verify USB Type‑C cables and adapters conform to specifications to prevent erroneous FRS signaling during disconnect events

Generated by OpenCVE AI on October 23, 2026 at 21:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98761.mbox
https://git.kernel.org/stable/c/184d842121e7d1fbc3a81895f36f72fa27444163
https://git.kernel.org/stable/c/7a7d9df0b82fbb40e70394b67a06670b9516ff94
https://git.kernel.org/stable/c/90156585765b29304f07b0e4a1c56a969876fcfc
https://git.kernel.org/stable/c/ae8aae45a39fcf2c64813652fcb062eace220712
https://git.kernel.org/stable/c/b2ed8643face247e513fad12e193378ba67a61a1
https://git.kernel.org/stable/c/b321eaa21555889aa42c4b45627f544565dc82c1
https://git.kernel.org/stable/c/d6b0cce612636f79f2cf0652fce40a0cbff7f0ed
https://nvd.nist.gov/vuln/detail/CVE-2026-98761
https://www.cve.org/CVERecord?id=CVE-2026-98761

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7a7d9df0b82fbb40e70394b67a06670b9516ff94 https://git.kernel.org/stable/c/b321eaa21555889aa42c4b45627f544565dc82c1

Fri, 23 Oct 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665 CWE-676

Fri, 23 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-390
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98761.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98761 https://www.cve.org/CVERecord?id=CVE-2026-98761
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.0, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/ae8aae45a39fcf2c64813652fcb062eace220712

Sun, 18 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665 CWE-676

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FAST_ROLE_SWAP AMS by initiating error recovery on it. This helps in cases where some cables (incorrectly) signal an FRS to an FRS capable port during disconnection. The TCPC autonomously starts sourcing VBUS on detecting the FRS signal. However, the VBUS sourcing is left on when the FAST_ROLE_SWAP AMS fails to start (as tcpm_sink_tx_ok is 0 as CC is open due to the cable disconnect). This is because the code sets the state to INVALID_STATE without resetting the port state. Log snippet before changes: [ 101.401960] AMS FAST_ROLE_SWAP start [ 101.401971] Sink TX No Go [ 101.401982] sourcing vbus [ 101.401987] VBUS on [ 101.402159] VBUS on [ 109.257809] CC1: 0 -> 0, CC2: 5 -> 0 [state SNK_READY, polarity 1, disconnected] [ 111.267442] VBUS on After changes: [ 70.541211] AMS FAST_ROLE_SWAP start [ 70.541220] Sink TX No Go [ 70.541228] state change SNK_READY -> ERROR_RECOVERY [rev3 NONE_AMS] [ 70.541362] VBUS on [ 70.541365] sourcing vbus [ 70.541367] VBUS on [ 70.541374] state change ERROR_RECOVERY -> PORT_RESET [rev3 NONE_AMS] [ 70.541410] disable vbus discharge ret:0 [ 70.543028] Setting usb_comm capable false [ 70.544009] Setting voltage/current limit 0 mV 0 mA [ 70.544034] polarity 0 [ 70.544239] Requesting mux state 0, usb-role 0, orientation 0 [ 70.555550] cc:=0 [ 70.555595] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS] [ 70.555697] VBUS off [ 70.555702] VBUS VSAFE0V [ 70.555762] CC1: 5 -> 0, CC2: 0 -> 0 [state PORT_RESET, polarity 0, disconnected] [ 70.587794] VBUS off [ 70.587799] VBUS VSAFE0V [ 70.655672] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms] [ 70.655682] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [rev3 NONE_AMS] [ 70.655686] Start toggling [ 70.656274] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
Title		usb: typec: tcpm: recover after failure to start the frs ams
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/184d842121e7d1fbc3a81895f36f72fa27444163 https://git.kernel.org/stable/c/90156585765b29304f07b0e4a1c56a969876fcfc https://git.kernel.org/stable/c/b2ed8643face247e513fad12e193378ba67a61a1 https://git.kernel.org/stable/c/d6b0cce612636f79f2cf0652fce40a0cbff7f0ed

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:47:51.757Z

Updated: 2026-10-30T12:39:30.112Z

Reserved: 2026-09-25T10:25:14.368Z

Link: CVE-2026-98761

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:29.900

Modified: 2026-10-30T13:21:25.487

Link: CVE-2026-98761

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98761 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T21:30:04Z

Weaknesses

CWE-390
Detection of Error Condition Without Action

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object