PT-2026-36364 · Linux · Linux Kernel
Published
2026-05-01
·
Updated
2026-06-05
·
CVE-2026-31729
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
An out-of-bounds array access can occur in the
ucsi connector change() function. This happens because the connector number extracted from the Command Completion Interface (CCI) via UCSI CCI CONNECTOR() is a 7-bit field (0-127), while the connector array is only allocated based on the number of connectors reported by the device. A malicious or malfunctioning device could provide an out-of-range connector number, leading to the memory access issue. To prevent this, a bounds check was added to the ucsi notify common() function, which serves as the central point for parsing CCI data from hardware.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel