CVE-2026-31729
Out-of-Bounds Access in Linux Kernel USB Type-C UCSI
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's USB Type-C subsystem, specifically in the ucsi_notify_common() function. The issue arises because the connector number extracted from the device's CCI (Connector Capability Information) is a 7-bit value (0-127), but the kernel only allocates an array sized for the actual number of connectors reported by the device, usually between 2 and 4.
A malicious or malfunctioning device can report a connector number that is out of the valid range, causing the kernel to perform an out-of-bounds array access in the ucsi_connector_change() function. This can lead to undefined behavior or potential security issues.
The vulnerability was fixed by adding a bounds check in ucsi_notify_common() to reject invalid connector numbers before they are processed further.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow a malicious or malfunctioning USB Type-C device to cause the Linux kernel to access memory outside the bounds of an allocated array. This out-of-bounds access could lead to system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges.
The impact depends on the specific system and how it handles such memory errors, but it generally poses a risk to system reliability and security when connecting untrusted USB Type-C devices.