CVE-2026-64330

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in Linux Kernel USB TypeC TCPM

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() In svdm_consume_modes(), the SVID value is read from pmdata->svids using pmdata->svid_index as an array index without bounds validation: paltmode->svid = pmdata->svids[pmdata->svid_index]; If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data is embedded inside struct tcpm_port, indexing past svids reads into adjacent fields. In particular: - At index 16, it reads the altmodes count. - At index 18 and beyond, it reads into altmode_desc[], which contains partner-supplied SVDM Discovery Modes VDOs. By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index to 20, the partner can force paltmode->svid to be loaded with an arbitrary, partner- chosen SVID, which is then registered via typec_partner_register_altmode(). Fix this by validating that pmdata->svid_index is non-negative and strictly less than pmdata->nsvids before accessing the pmdata->svids array inside svdm_consume_modes().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64330

EUVD

EUVD-2026-48874

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's USB Type-C port manager (tcpm). It involves an out-of-bounds read in the svdm_consume_modes() function where the SVID index is used to access an array without validation. If the index exceeds the allowed limit (16), it reads adjacent memory, potentially allowing an attacker to inject a malicious SVID value.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB Type-C Port Manager (TCPM) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for out-of-bounds read errors or validating the svdm_consume_modes() function in the kernel source code. No direct network commands exist for detection as it is a local kernel issue.

Impact Analysis

An attacker with physical access to a USB Type-C port could exploit this to inject a malicious SVID, potentially leading to unauthorized device behavior or data exposure. Systems using vulnerable Linux kernel versions may be affected.

Compliance Impact

This vulnerability could lead to unauthorized data access or device manipulation, which may violate compliance requirements for data protection (e.g., GDPR, HIPAA) by exposing sensitive information or allowing unauthorized system access.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to ensure the fix for svdm_consume_modes() is included. If patches are unavailable, monitor vendor advisories for updates. Restart services or reboot systems after applying kernel updates to activate the patched code.

Hi! I’m here to help you understand CVE-2026-64330. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70