Executive brief
A vulnerability in the Linux kernel's USB Type-C connector manager could allow a malicious USB device to manipulate how it is identified by the system. By exploiting a lack of boundary checks when processing USB data, a connected device can force the system to register incorrect hardware profiles. This could lead to unauthorized hardware interactions or unexpected system behavior when a malicious device is physically plugged in.
Technical details
An out-of-bounds read exists in the Linux kernel's USB Type-C Port Manager (TCPM) within the svdm_consume_modes() function. The root cause is a failure to validate the 'svid_index' before using it to access the 'pmdata->svids' array. A malicious USB partner device can drive the index beyond the maximum allowed value (SVID_DISCOVERY_MAX), causing the kernel to read from adjacent memory fields in 'struct tcpm_port'. By carefully timing and structuring the Discovery SVDM responses, an attacker can inject a chosen Standard or Vendor ID (SVID) from adjacent memory into the registration process, potentially bypassing intended hardware restrictions. Patches have been released across multiple stable kernel branches to enforce strict bounds checking on the SVID index.
Affected products
- Linux Linux Kernel 4ab8c18d4d67 to 89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53
Timeline
- 2026-06-22: other: Patch submitted by developer
- 2026-07-24: patched: Commits merged into stable trees
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407
- https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b
- https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4
- https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491
- https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53
- https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f
- https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c