PT-2026-61275 · Linux · Linux

CVE-2026-63958 · Published 2026-07-19 · Updated 2026-07-19

NVD

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: validate connector number in ucsi connector change()

The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi connector change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule work() on memory past the end of the array.

Reject connector numbers that are zero or exceed cap.num connectors before dereferencing the array.

Related Identifiers

CVE-2026-63958

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-63958 · Security Note
• https://git.kernel.org/stable/c/cea949203faef9cb783adc7b978cce056271e057 · Note
• https://git.kernel.org/stable/c/bd24d92af4ae021b6209f28e9a57e1bf2260d4fd · Note
• https://git.kernel.org/stable/c/288a81a8507052bcfbf884d39a463c44c42c5fd9 · Note
• https://git.kernel.org/stable/c/156b6f0aec6108909b0c4aedc78865b12766b347 · Note
• https://git.kernel.org/stable/c/0edd1e21587b0483c7ceb993b9fb9668bbef7433 · Note
• https://git.kernel.org/stable/c/5af2719b460ab904c504fc069d1dd2a3aa2b22b0 · Note