PT-2026-61275 · Linux · Linux

CVE-2026-63958 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: validate connector number in ucsi connector change()

The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi connector change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule work() on memory past the end of the array.

Reject connector numbers that are zero or exceed cap.num connectors before dereferencing the array.

Identificadores relacionados

CVE-2026-63958

Produtos afetados

Linux

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-63958 · Nota de Segurança
• https://git.kernel.org/stable/c/cea949203faef9cb783adc7b978cce056271e057 · Nota
• https://git.kernel.org/stable/c/bd24d92af4ae021b6209f28e9a57e1bf2260d4fd · Nota
• https://git.kernel.org/stable/c/288a81a8507052bcfbf884d39a463c44c42c5fd9 · Nota
• https://git.kernel.org/stable/c/156b6f0aec6108909b0c4aedc78865b12766b347 · Nota
• https://git.kernel.org/stable/c/0edd1e21587b0483c7ceb993b9fb9668bbef7433 · Nota
• https://git.kernel.org/stable/c/5af2719b460ab904c504fc069d1dd2a3aa2b22b0 · Nota