Executive brief
A security vulnerability was identified in the Linux kernel's USB Type-C driver for WCOVE hardware. A malicious USB device connected to the system could send a specially crafted message that causes the driver to write data beyond its intended memory buffer. This could lead to system instability or potentially allow for further exploitation by an attacker with physical access to the USB port.
Technical details
A buffer overflow exists in wcove_read_rx_buffer() within drivers/usb/typec/tcpm/wcove.c. The vulnerability is caused by two issues: first, the USBC_RXINFO_RXBYTES field can report up to 31 bytes while the destination struct pd_message is only 30 bytes; second, regmap_read() performs 4-byte writes into a byte-aligned buffer, causing trailing zero-bytes to overwrite stack memory in the final iteration. An attacker with a malicious USB Power Delivery partner can trigger an out-of-bounds write on the IRQ thread's stack. The fix involves clamping the read length to the size of the destination structure and using a local variable to ensure only single bytes are written to the buffer.
Affected products
- Linux Linux Kernel drivers/usb/typec/tcpm/wcove.c
Timeline
- 2026-05-13: patched: Initial patch authored
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/3e632098d0521257ea965bbd6fde807d9bee5c8a
- https://git.kernel.org/stable/c/3f9d50c8b02b4af0646aa892465080f9061fc89c
- https://git.kernel.org/stable/c/4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa
- https://git.kernel.org/stable/c/5cd0e7ac4eefbdb330f8c72694fe74e63df65552
- https://git.kernel.org/stable/c/6899f5b6d7b83ce79a3d331dc61dd31bf73f9c22
- https://git.kernel.org/stable/c/d0e4b8b3c6b7607a16932556eaaca5d5cf69f192
- https://git.kernel.org/stable/c/e94933dc41b87503bf585c8c6d53d740620eceb9