CVE-2026-64463
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
rt1711h_probe() registers the TCPCI port before requesting the interrupt
and enabling alert interrupts. If either of those later steps fails, the
probe function returns without unregistering the TCPCI port. The explicit
unregister currently only happens from the remove callback.
Register a devres action immediately after tcpci_register_port() succeeds,
so tcpci_unregister_port() runs on later probe failures and on driver
detach. Drop the remove callback to avoid unregistering the same port
twice.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
CSIRTS triage
- What
- There is an issue with unregistering the TCPCI port in the USB Type-C driver.
- Who is affected
- Deployments of the Linux kernel with USB Type-C support may be affected.
- Urgency
- Remediation is advisable to ensure proper device management, though exploitation is not currently known.
- Action
- Monitor for updates regarding this issue.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-64463
Get an email if CVE-2026-64463 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-64463)