Executive brief
A vulnerability in the Linux kernel's USB-C software could allow a malicious USB device to access sensitive information from the computer's memory. By sending a specially crafted identification message, a connected device can bypass security checks and read data it should not have access to. This issue primarily affects systems using the Type-C Port Manager (TCPM) and requires physical access to plug in a device.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's USB Type-C Port Manager (TCPM) within the `drivers/usb/typec/tcpm/tcpm.c` component. The functions `svdm_consume_identity()` and `svdm_consume_identity_sop_prime()` do not sufficiently validate the VDO count provided by a connected USB device. A malicious device can provide a crafted count that causes the kernel to index past the bounds of static arrays when processing Discover Identity ACK messages. This can result in the leakage of kernel memory data to the device. The issue has been patched in stable branches 6.12.93, 6.18.35, and 7.0.12.
Affected products
- Linux Linux Kernel versions before 6.12.93, 6.18.35, 7.0.12
Timeline
- 2026-05-13: other: Initial patch authored
- 2026-07-19: disclosed: CVE published
- 2026-07-19: patched: Fixes integrated into stable releases