CVE-2026-46134: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration cros_typec_register_thunderbolt() missed initializing the `adata->lock` mutex. This leads to a NULL dereference when the mutex is later acquired (e.g. in cros_typec_altmode_work()). Initialize the mutex in cros_typec_register_thunderbolt() to fix the issue.

Affected products

• Linux Linux Kernel: from 6.14, before 6.18.30 (fixed in 6.18.30); from 6.19, before 7.0.7 (fixed in 7.0.7); version 7.1 only

Published 2026-05-28. Last modified 2026-06-24.