CVE-2026-63962: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: bound altmodedesc[] per iteration in svdmconsumemodes()
svdmconsumemodes() checks pmdata->altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop.
In the well-behaved SVDM discovery flow this is harmless because each of at most SVIDDISCOVERYMAX SVIDs contributes at most MODEDISCOVERYMAX modes, exactly filling altmodedesc[ALTMODEDISCOVERYMAX]. But the CMDTRSPACK handler in tcpmpdsvdm() does not correlate an incoming ACK with any request the port actually sent. Once port->partner is set, an unsolicited Discover Modes ACK is consumed unconditionally. A broken or malicious port partner can therefore drive altmodes to ALTMODEDISCOVERYMAX - 1 via the normal flow, and then send one extra Discover Modes ACK with seven VDOs. Because the pre-loop check passes, the loop could then writes up to five entries past altmodedesc[]. For modedataprime the next field in struct tcpmport is the partneraltmode[] pointer array, which then receives partner-chosen SVID/VDO bytes.
Move the bound check inside the loop so the array can never be indexed past ALTMODEDISCOVERYMAX regardless of how many VDOs the partner supplies or how the function was reached.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.93 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.35 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.0.12 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-28.28~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-28.28.1~24.04.3 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-28.28 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1003.4 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2016.16 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-28.28.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-28.28.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.0.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In Linux kernel usb: typec: tcpm, move the altmode_desc[] bound check inside the loop in svdm_consume_modes() so the array cannot be indexed past ALTMODE_DISCOVERY_MAX regardless of how many VDOs the partner supplies.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63962?
The severity of CVE-2026-63962 is rated as 60, indicating a moderate risk.
How do I fix CVE-2026-63962?
To fix CVE-2026-63962, ensure you update to the latest version of the Linux kernel that includes the patch addressing this vulnerability.
What systems are affected by CVE-2026-63962?
CVE-2026-63962 affects systems running vulnerable versions of the Linux kernel that implement USB Type-C and TCPM functionalities.
What impact does CVE-2026-63962 have on security?
CVE-2026-63962 could potentially allow attackers to exploit unbounded altmode descriptors, leading to unexpected behavior in Type-C connections.
When was CVE-2026-63962 published?
CVE-2026-63962 was published on July 19, 2026.