Riskcovery

CVE-2026-31729

usb: typec: ucsi: validate connector number in ucsi_notify_common()

State
Published
Severity
Not scored
Published
May 1, 2026
Updated
May 11, 2026
Reserved
Mar 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: validate connector number in ucsi_notify_common()

The connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a 7-bit field (0-127) that is used to index into the connector array in ucsi_connector_change(). However, the array is only allocated for the number of connectors reported by the device (typically 2-4 entries).

A malicious or malfunctioning device could report an out-of-range connector number in the CCI, causing an out-of-bounds array access in ucsi_connector_change().

Add a bounds check in ucsi_notify_common(), the central point where CCI is parsed after arriving from hardware, so that bogus connector numbers are rejected before they propagate further.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • bdc62f2bae8fb0e8e99574de5232f0a3c54a27df to before f6dcbf2b024d55549959402f1db6c614e51d52cbAffected
  • bdc62f2bae8fb0e8e99574de5232f0a3c54a27df to before f4e608fe12b7ac6a4a57176ab0296bb5a110a078Affected
  • bdc62f2bae8fb0e8e99574de5232f0a3c54a27df to before 98429e9ec89a5e3a204112dfaa2dbe6ca28493a0Affected
  • bdc62f2bae8fb0e8e99574de5232f0a3c54a27df to before d2d8c17ac01a1b1f638ea5d340a884ccc5015186Affected
LinuxLinux
  • 5.5Affected
  • before 5.5Not affected
  • 6.12.81 through 6.12.*Not affected
  • 6.18.22 through 6.18.*Not affected
  • 6.19.12 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.