Executive brief
A vulnerability in the Linux kernel's USB Type-C UCSI CCG driver could allow a user with administrative (root) privileges to crash the system. By providing a specially crafted, malformed firmware file, an attacker can trigger a kernel 'oops' or crash during a firmware update process. This primarily impacts system availability, potentially leading to a denial-of-service.
Technical details
A vulnerability exists in the do_flash() function within drivers/usb/typec/ucsi/ucsi_ccg.c of the Linux kernel. The code uses strnchr() to locate ':' record headers in firmware images; however, if no such header exists, strnchr() returns NULL. Because NULL is numerically less than the 'eof' pointer, the subsequent loop executes with an invalid pointer (NULL + 1), leading to a kernel oops/crash. An attacker with root privileges can exploit this by placing a crafted firmware file in /lib/firmware and triggering the update via the do_flash sysfs attribute. The issue has been resolved by adding a check to reject firmware images that do not contain the required ':' record header.
Affected products
- Linux Linux Kernel 5.10.259; 5.15.161; 6.1.94; 6.6.34; 6.9.5; 6.10-rc1
Timeline
- 2026-05-14: patched: Initial patch authored
- 2026-07-19: advisory: CVE-2026-63964 published
References
- https://git.kernel.org/stable/c/2f395ca1263bd181995eb829f5943a83a20db213
- https://git.kernel.org/stable/c/3f432b8203066c26770fe6ea591361f10021dd6b
- https://git.kernel.org/stable/c/6526f8684f72391138353642af908803ba70795e
- https://git.kernel.org/stable/c/a38ed87818b2419090fb1a6338ddce6842b65dfa
- https://git.kernel.org/stable/c/b41dfc033fe594e152648050e95b9489cd53e9e3
- https://git.kernel.org/stable/c/c4ee519b06389e59ba2d6aa722fcc4a02a8bbcbb
- https://git.kernel.org/stable/c/c8460de584fe5415d212cfdd127d4db90835a450