CVE-2026-63962
- Source
- https://cve.org/CVERecord?id=CVE-2026-63962
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63962.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-63962
- Downstream
- Related
- Published
- 2026-07-19T14:55:51Z
- Modified
- 2026-08-31T18:27:01Z
- Summary
- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
svdm_consume_modes() checks pmdata->altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop.
In the well-behaved SVDM discovery flow this is harmless because each of at most SVID_DISCOVERY_MAX SVIDs contributes at most MODE_DISCOVERY_MAX modes, exactly filling altmode_desc[ALTMODE_DISCOVERY_MAX]. But the CMDT_RSP_ACK handler in tcpm_pd_svdm() does not correlate an incoming ACK with any request the port actually sent. Once port->partner is set, an unsolicited Discover Modes ACK is consumed unconditionally. A broken or malicious port partner can therefore drive altmodes to ALTMODE_DISCOVERY_MAX - 1 via the normal flow, and then send one extra Discover Modes ACK with seven VDOs. Because the pre-loop check passes, the loop could then writes up to five entries past altmode_desc[]. For mode_data_prime the next field in struct tcpm_port is the partner_altmode[] pointer array, which then receives partner-chosen SVID/VDO bytes.
Move the bound check inside the loop so the array can never be indexed past ALTMODE_DISCOVERY_MAX regardless of how many VDOs the partner supplies or how the function was reached.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63962.json" }- References
-
- https://git.kernel.org/stable/c/3389c149c68c3fea61910ad5d34f7bf3bff44e32
- https://git.kernel.org/stable/c/4505f33dab56c274e82f47f94bf60a8cbf8f4b42
- https://git.kernel.org/stable/c/845598b154b9a92e9d279fafafa9405c121ae805
- https://git.kernel.org/stable/c/cbad85b446c06adbc5e5bed565871bb918ce9d32
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63962.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-63962
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4ab8c18d4d67321cc7b660559de17511d4fc0237Fixed845598b154b9a92e9d279fafafa9405c121ae805Fixed4505f33dab56c274e82f47f94bf60a8cbf8f4b42Fixedcbad85b446c06adbc5e5bed565871bb918ce9d32Fixed3389c149c68c3fea61910ad5d34f7bf3bff44e32