CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common()
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: validate connector number in ucsinotifycommon()
The connector number extracted from CCI via UCSICCICONNECTOR() is a 7-bit field (0-127) that is used to index into the connector array in ucsiconnectorchange(). However, the array is only allocated for the number of connectors reported by the device (typically 2-4 entries).
A malicious or malfunctioning device could report an out-of-range connector number in the CCI, causing an out-of-bounds array access in ucsiconnectorchange().
Add a bounds check in ucsinotifycommon(), the central point where CCI is parsed after arriving from hardware, so that bogus connector numbers are rejected before they propagate further.
Affected Software
Remediation
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel UCSI USB Type-C subsystem are exposed when a UCSI device can supply connector-change information. The issue arises because the device-reported connector number can exceed the number of connector-array entries allocated by the kernel.
What would an attacker or faulty device need to do?
The device must report a bogus, out-of-range connector number in the CCI notification. That value can then reach ucsi_connector_change() and be used as an array index unless the bounds-checking fix is present.
Is physical or local access required?
The CVSS vector lists local attack vector and low privileges, with no user interaction required. The provided description specifically identifies a malicious or malfunctioning UCSI device as the source of the malformed connector number.
What mitigation is available?
A patch is available that validates the connector number in ucsi_notify_common() and rejects invalid values before they reach downstream connector handling. No alternative mitigation is provided in the available data.