PT-2026-61277 · Linux · Linux

CVE-2026-63960

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: wcove: don't write past struct pd message in wcove read rx buffer()
wcove read rx buffer() copies the PD RX FIFO into the caller's struct pd message with
for (i = 0; i < USBC RXINFO RXBYTES(info); i++)
	regmap read(wcove->regmap, USBC RX DATA + i, msg + i);
which has two problems:
USBC RXINFO RXBYTES() is a 5-bit field (max 31) while struct pd message is 30 bytes ( le16 header + le32 payload[PD MAX PAYLOAD], packed). The byte count latched in RXINFO is the number of bytes the port partner put on the wire, so a malicious partner that transmits a 31-byte frame can drive the loop one byte past the destination if the WCOVE BMC receiver does not enforce the PD object-count limit in hardware. The existing FIXME flagged this as unverified.
Independently, regmap read() takes an unsigned int * and stores a full unsigned int at the destination. Passing the byte pointer msg + i means each iteration writes four bytes; the high three are zero (val bits is 8) and are normally overwritten by the next iteration, but the final iteration's high bytes are not. With RXBYTES == 30 the i == 29 iteration already writes three zero bytes past msg, which sits on the IRQ thread's stack in wcove typec irq().
Clamp the loop to sizeof(struct pd message) and read each register into a local before storing only its low byte, so the copy can never exceed the destination regardless of what RXINFO reports.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-63960

Produtos afetados

Linux