Riskcovery

CVE-2026-63963

usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers

State
Published
Severity
Not scored
Published
Jul 19, 2026
Updated
Oct 30, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers

Properly validate the count passed from a device when calling svdm_consume_identity() or svdm_consume_identity_sop_prime() as the device-controlled value could index off of the static arrays, which could leak data.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f0690a25a140b853b1842fa80faf828601bb47e8 to before 150c30131c032b4b1ad9acd29f2834321d85ae4bAffected
  • f0690a25a140b853b1842fa80faf828601bb47e8 to before 6bacd22e1eae77abf089bbdc016270200a8dc83bAffected
  • f0690a25a140b853b1842fa80faf828601bb47e8 to before 569f7971542eb10025d8a0989b83f28a29d8ba20Affected
  • f0690a25a140b853b1842fa80faf828601bb47e8 to before f9d787fbe83127105e42088cca40e5118db0d810Affected
  • f0690a25a140b853b1842fa80faf828601bb47e8 to before ed8649f3822e211d025bcab5158af6f8a38c8705Affected
  • f0690a25a140b853b1842fa80faf828601bb47e8 to before 8fbc349e8383125dd2d8de1c1e926279d398ab17Affected
LinuxLinux
  • 4.12Affected
  • before 4.12Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.93 through 6.12.*Not affected
  • 6.18.35 through 6.18.*Not affected
  • 7.0.12 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.