{"id":"CVE-2026-90028","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: hd3ss3220: track VBUS enable state per consumer\n\nregulator_is_enabled() reports the aggregate regulator state, not\nwhether this consumer holds an enable ref…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: hd3ss3220: track VBUS enable state per consumer\n\nregulator_is_enabled() reports the aggregate regulator state, not\nwhether this consumer holds an enable ref…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= b3f9d6e491fda73c319547881b78cdd2a222b293 < df7cd3908e07503fa7e9737dacf44208530e58d9","Linux >= b3f9d6e491fda73c319547881b78cdd2a222b293 < c9a48db776d7184981630ecc01a3ad30a8f7dc24","Linux 7.0"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T11:17:15.837","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90028","references":[{"url":"https://git.kernel.org/stable/c/c9a48db776d7184981630ecc01a3ad30a8f7dc24","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df7cd3908e07503fa7e9737dacf44208530e58d9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.938Z","epss":0.00176,"epssPercentile":0.07452,"slug":"CVE-2026-90028","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: hd3ss3220: track VBUS enable state per consumer\n\nregulator_is_enabled() reports the aggregate regulator state, not\nwhether this consumer holds an enable reference. If another consumer\nenables VBUS first, the driver can skip its own regulator_enable() call\nand later attempt to drop a reference it never acquired, triggering an\nunbalanced regulator disable warning.\n\nTrack successful enable and disable calls locally. Keep the state\nunchanged when an operation fails so a later role or ID notification\nretries the operation while this consumer keeps balanced references.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}