---
id: CVE-2026-90026
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: typec: qcom-pmic: cancel reset_work on stop

  pdphy_stop() disables IRQs but leaves reset_work pending
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: typec: qcom-pmic: cancel reset_work on stop

  pdphy_stop() disables IRQs but leaves reset_work pending.  If the IRQ
  handler schedules it just before disable_irq(), …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a4422ff221429c600c3dc5d0394fb3738b89d040 <
    0b69b166852dbf1f9532b22bd49f502e5970eb95
  - >-
    Linux >= a4422ff221429c600c3dc5d0394fb3738b89d040 <
    b9a7eed472edbfa8dec0fdeafd5e796550a8a8b7
  - >-
    Linux >= a4422ff221429c600c3dc5d0394fb3738b89d040 <
    d4e00a1eb39174e25ef759b8fb1111bba8e87b1e
  - >-
    Linux >= a4422ff221429c600c3dc5d0394fb3738b89d040 <
    52d556f08547733948cc40b8b11e6b68dccee7b2
  - >-
    Linux >= a4422ff221429c600c3dc5d0394fb3738b89d040 <
    7b0df6efd143f8085bdb68778a013a46f1349913
  - Linux 6.5
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:25.923'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90026'
references:
  - url: 'https://git.kernel.org/stable/c/0b69b166852dbf1f9532b22bd49f502e5970eb95'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/52d556f08547733948cc40b8b11e6b68dccee7b2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7b0df6efd143f8085bdb68778a013a46f1349913'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b9a7eed472edbfa8dec0fdeafd5e796550a8a8b7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d4e00a1eb39174e25ef759b8fb1111bba8e87b1e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.935Z'
epss: 0.00175
epssPercentile: 0.06165
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: qcom-pmic: cancel reset_work on stop

pdphy_stop() disables IRQs but leaves reset_work pending.  If the IRQ
handler schedules it just before disable_irq(), the work runs after
remove() frees the struct via devm.

Call cancel_work_sync() after disabling IRQs to close the window.

This issue was found by an in-house static analysis tool.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.