CVE-2026-63958

Received Received - Intake

Type-C UCSI Connector Number Validation Flaw in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-20

Generated

2026-07-20

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-63958

EUVD

EUVD-2026-45731

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the USB Type-C Subsystem (UCSI) where the connector number from a UCSI CCI notification is not properly validated. The connector number is a 7-bit field that can exceed the actual number of connectors the system supports, leading to an out-of-bounds array access in the ucsi_connector_change() function. This could allow a buggy or malicious PPM (Platform Policy Manager) to trigger memory corruption by accessing memory outside the allocated array.

Detection Guidance

This vulnerability affects the Linux kernel's USB Type-C UCSI subsystem. Detection requires checking kernel logs for UCSI-related errors or crashes, particularly involving connector number validation failures. Monitor dmesg or journalctl for messages like 'ucsi_connector_change' errors or out-of-bounds array accesses.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or potential privilege escalation if exploited by a malicious PPM. Users might experience instability, data corruption, or denial of service if the system is compromised. Systems using affected Linux kernel versions with UCSI support are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a low-level kernel issue in USB Type-C handling that could allow memory corruption or crashes if exploited, but it does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this vulnerability is patched. If immediate patching is not possible, disable the UCSI subsystem by blacklisting the ucsi module or restricting access to Type-C controllers until the update is applied.

Hi! I’m here to help you understand CVE-2026-63958. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70