SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-63958

UNKNOWN · CVSS N/A EPSS 0.21%

Source: NVD + CISA KEV + EPSS · Published 2026-07-19 · Last synced 2026-08-18

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's handling of UCSI connector notifications, specifically in the ucsi_connector_change() function, which improperly validates connector numbers. This flaw allows a malicious or faulty Power Management Processor (PPM) to trigger memory access beyond the allocated array, potentially leading to memory corruption or arbitrary code execution. Organizations using Linux systems with UCSI controllers, particularly those relying on EC firmware or I2C connections, should prioritize addressing this vulnerability to mitigate security risks.

CVE
CVE-2026-63958
Severity
UNKNOWN
CVSS
N/A
EPSS
0.21%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array.