CVE-2026-63963

Received Received - Intake

TypeC USB Port Identity Validation Flaw in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdm_consume_identity() or svdm_consume_identity_sop_prime() as the device-controlled value could index off of the static arrays, which could leak data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-20

Generated

2026-07-20

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-63963

EUVD

EUVD-2026-45736

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of the VDO count from a device when processing Discover Identity ACK messages. The device-controlled value could exceed array bounds in svdm_consume_identity() or svdm_consume_identity_sop_prime(), potentially causing out-of-bounds reads and leaking sensitive data.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB Type-C protocol manager (tcpm). Detection requires checking kernel logs for Type-C related errors or examining kernel source code for improper VDO count validation in Discover Identity ACK handlers.

Impact Analysis

An attacker with physical or logical access to a system using the affected Linux kernel could exploit this flaw to read unauthorized memory contents. This may lead to information disclosure, including sensitive data like passwords or encryption keys, depending on the system configuration.

Compliance Impact

This vulnerability could compromise data confidentiality, violating GDPR's principle of data protection by design and default or HIPAA's requirement for safeguarding protected health information. Organizations may face compliance violations if exploited, leading to legal and financial penalties.

Mitigation Strategies

Apply the latest Linux kernel updates that include the fix for this vulnerability. Monitor kernel logs for Type-C related errors and ensure your system is running a patched kernel version.

Hi! I’m here to help you understand CVE-2026-63963. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70