CVE-2026-98761
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.17 %mayor que el 6 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
usb: typec: tcpm: recuperar tras un fallo al iniciar la AMS de FRS
Restablece el puerto si el tcpm no logra iniciar la AMS FAST_ROLE_SWAP, iniciando en él la recuperación de errores.
Esto ayuda en los casos en que algunos cables señalan (incorrectamente) una FRS a un puerto compatible con FRS durante la desconexión. El TCPC empieza a suministrar VBUS de forma autónoma al detectar la señal FRS. Sin embargo, el suministro de VBUS se mantiene activo cuando la AMS FAST_ROLE_SWAP no logra iniciarse (ya que tcpm_sink_tx_ok es 0 porque CC está abierto debido a la desconexión del cable). Esto se debe a que el código establece el estado en INVALID_STATE sin restablecer el estado del puerto.
Detalles técnicos trazas, registros y código del informe original
Registro antes de los cambios: [ 101.401960] AMS FAST_ROLE_SWAP start [ 101.401971] Sink TX No Go [ 101.401982] sourcing vbus [ 101.401987] VBUS on [ 101.402159] VBUS on [ 109.257809] CC1: 0 -> 0, CC2: 5 -> 0 [state SNK_READY, polarity 1, disconnected] [ 111.267442] VBUS on Después de los cambios: [ 70.541211] AMS FAST_ROLE_SWAP start [ 70.541220] Sink TX No Go [ 70.541228] state change SNK_READY -> ERROR_RECOVERY [rev3 NONE_AMS] [ 70.541362] VBUS on [ 70.541365] sourcing vbus [ 70.541367] VBUS on [ 70.541374] state change ERROR_RECOVERY -> PORT_RESET [rev3 NONE_AMS] [ 70.541410] disable vbus discharge ret:0 [ 70.543028] Setting usb_comm capable false [ 70.544009] Setting voltage/current limit 0 mV 0 mA [ 70.544034] polarity 0 [ 70.544239] Requesting mux state 0, usb-role 0, orientation 0 [ 70.555550] cc:=0 [ 70.555595] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS] [ 70.555697] VBUS off [ 70.555702] VBUS VSAFE0V [ 70.555762] CC1: 5 -> 0, CC2: 0 -> 0 [state PORT_RESET, polarity 0, disconnected] [ 70.587794] VBUS off [ 70.587799] VBUS VSAFE0V [ 70.655672] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms] [ 70.655682] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [rev3 NONE_AMS] [ 70.655686] Start toggling [ 70.656274] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 6
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98761",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0908c5aca31eb5e0c72d7a5dba422629b88e877d",
"lessThan": "184d842121e7d1fbc3a81895f36f72fa27444163",
"versionType": "git"
},
{
"status": "affected",
"version": "0908c5aca31eb5e0c72d7a5dba422629b88e877d",
"lessThan": "b2ed8643face247e513fad12e193378ba67a61a1",
"versionType": "git"
},
{
"status": "affected",
"version": "0908c5aca31eb5e0c72d7a5dba422629b88e877d",
"lessThan": "d6b0cce612636f79f2cf0652fce40a0cbff7f0ed",
"versionType": "git"
},
{
"status": "affected",
"version": "0908c5aca31eb5e0c72d7a5dba422629b88e877d",
"lessThan": "90156585765b29304f07b0e4a1c56a969876fcfc",
"versionType": "git"
}
],
"programFiles": [
"drivers/usb/typec/tcpm/tcpm.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/usb/typec/tcpm/tcpm.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:29.900",
"references": [
{
"url": "https://git.kernel.org/stable/c/184d842121e7d1fbc3a81895f36f72fa27444163",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/90156585765b29304f07b0e4a1c56a969876fcfc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b2ed8643face247e513fad12e193378ba67a61a1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d6b0cce612636f79f2cf0652fce40a0cbff7f0ed",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: recover after failure to start the frs ams\n\nReset the port if the tcpm fails to start the FAST_ROLE_SWAP AMS by\ninitiating error recovery on it.\n\nThis helps in cases where some cables (incorrectly) signal an FRS to\nan FRS capable port during disconnection. The TCPC autonomously starts\nsourcing VBUS on detecting the FRS signal. However, the VBUS sourcing is\nleft on when the FAST_ROLE_SWAP AMS fails to start (as tcpm_sink_tx_ok\nis 0 as CC is open due to the cable disconnect). This is because the\ncode sets the state to INVALID_STATE without resetting the port state.\n\nLog snippet before changes:\n[ 101.401960] AMS FAST_ROLE_SWAP start\n[ 101.401971] Sink TX No Go\n[ 101.401982] sourcing vbus\n[ 101.401987] VBUS on\n[ 101.402159] VBUS on\n[ 109.257809] CC1: 0 -> 0, CC2: 5 -> 0 [state SNK_READY, polarity 1, disconnected]\n[ 111.267442] VBUS on\n\nAfter changes:\n[ 70.541211] AMS FAST_ROLE_SWAP start\n[ 70.541220] Sink TX No Go\n[ 70.541228] state change SNK_READY -> ERROR_RECOVERY [rev3 NONE_AMS]\n[ 70.541362] VBUS on\n[ 70.541365] sourcing vbus\n[ 70.541367] VBUS on\n[ 70.541374] state change ERROR_RECOVERY -> PORT_RESET [rev3 NONE_AMS]\n[ 70.541410] disable vbus discharge ret:0\n[ 70.543028] Setting usb_comm capable false\n[ 70.544009] Setting voltage/current limit 0 mV 0 mA\n[ 70.544034] polarity 0\n[ 70.544239] Requesting mux state 0, usb-role 0, orientation 0\n[ 70.555550] cc:=0\n[ 70.555595] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS]\n[ 70.555697] VBUS off\n[ 70.555702] VBUS VSAFE0V\n[ 70.555762] CC1: 5 -> 0, CC2: 0 -> 0 [state PORT_RESET, polarity 0, disconnected]\n[ 70.587794] VBUS off\n[ 70.587799] VBUS VSAFE0V\n[ 70.655672] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms]\n[ 70.655682] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [rev3 NONE_AMS]\n[ 70.655686] Start toggling\n[ 70.656274] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]"
}
],
"lastModified": "2026-10-19T10:19:40.213",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}