Executive brief
A vulnerability in the Linux kernel's USB Type-C driver could allow a malicious or malfunctioning USB device to access sensitive information. By sending a specially crafted message, a device could trick the computer into reading internal memory that it shouldn't have access to. This could lead to the exposure of private data from the system's memory to the connected device.
Technical details
A vulnerability exists in 'drivers/usb/typec/altmodes/displayport.c' within the Linux kernel. The 'dp_altmode_vdm' function handles 'DP_CMD_STATUS_UPDATE' messages without verifying that the 'count' parameter is sufficient (at least 2) before accessing the VDO data. A malicious or malformed USB device can provide an incorrect count, causing the kernel to read uninitialized stack memory and potentially transmit it back to the device or other components. This is a classic information leak resulting from a lack of input validation on hardware-provided metadata. Patches have been released across multiple stable kernel branches (5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.12.y, 6.18.y, and 7.0.y).
Affected products
- Linux Linux Kernel 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12
Timeline
- 2026-07-19: disclosed: CVE published and kernel patches identified.
References
- https://git.kernel.org/stable/c/64bd6ccc5799f8473d1f37d4d8f53093dfec5c02
- https://git.kernel.org/stable/c/6ffdbcd7a02f3af8fff9b6519830369f574ed44c
- https://git.kernel.org/stable/c/70e7045849e954e56dcbf441b6330e66bc996306
- https://git.kernel.org/stable/c/74aabe9ea30fdfba924fce9594e6aa69a596a4bb
- https://git.kernel.org/stable/c/77a759ec30bc5fb0dd9c867b711d0acfed6c7faa
- https://git.kernel.org/stable/c/8a18f896e667df491331371b55d4ad644dc51d60
- https://git.kernel.org/stable/c/b10eff5abe6aa2a5af10ed17bddff76e3b6e6b9b