CVE-2026-31729: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31729 Overview

CVE-2026-31729 is an out-of-bounds array access vulnerability in the Linux kernel's USB Type-C Connector System Interface (UCSI) subsystem. The flaw resides in the ucsi_notify_common() function within the usb: typec: ucsi driver. The connector number extracted from the Command Completion Indicator (CCI) via the UCSI_CCI_CONNECTOR() macro is a 7-bit field that can represent values 0–127. The kernel uses this value to index the connector array in ucsi_connector_change(), but the array typically only contains 2–4 entries based on hardware-reported capacity. A malicious or malfunctioning USB Type-C device can report an out-of-range connector number, triggering an out-of-bounds read or write in kernel memory.

Critical Impact

A local attacker with a malicious or malfunctioning USB Type-C device can trigger out-of-bounds kernel memory access, potentially leading to memory corruption, privilege escalation, or system compromise.

Affected Products

• Linux Kernel (multiple stable branches prior to fix)
• Linux Kernel 7.0-rc1 through 7.0-rc6
• Systems using the usb: typec: ucsi driver for USB Type-C connector management

Discovery Timeline

• 2026-05-01 - CVE-2026-31729 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-31729

Vulnerability Analysis

The vulnerability is an improper validation of array index issue [CWE-129] in the Linux kernel UCSI subsystem. UCSI is the standardized interface used by the kernel to communicate with USB Type-C Power Delivery controllers. When the controller signals an event, it writes status into the CCI register. The UCSI_CCI_CONNECTOR() macro extracts a 7-bit connector identifier from this register, allowing values from 0 to 127.

The kernel allocates the connector tracking array based on the number of connectors the device reports during initialization, which is typically 2 to 4 entries on real hardware. However, ucsi_connector_change() uses the CCI-derived connector number directly as an array index without verifying the value falls within the allocated bounds. A device that reports a connector number larger than the allocated array size causes the kernel to access memory outside the array.

Root Cause

The root cause is the absence of a bounds check between the value extracted by UCSI_CCI_CONNECTOR() and the actual ucsi->cap.num_connectors field. The kernel trusted hardware-supplied CCI data without validation. The fix introduces a bounds check in ucsi_notify_common(), which is the central parse point for incoming CCI data from hardware. Bogus connector numbers are now rejected before propagating to downstream handlers.

Attack Vector

Exploitation requires local access with the ability to attach or emulate a USB Type-C device. The attack vector is local with low attack complexity and low privileges required. Adversaries can use a malicious USB Type-C device, a programmable hardware emulator, or compromised firmware on an existing peripheral to send crafted CCI values containing out-of-range connector identifiers. Compromise of impacted systems can lead to high impact on confidentiality, integrity, and availability through kernel memory corruption.

No public proof-of-concept code or exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.023%, reflecting low expected exploitation probability in the immediate term.

Detection Methods for CVE-2026-31729

Indicators of Compromise

• Unexpected kernel oops, panic, or KASAN reports referencing ucsi_connector_change or ucsi_notify_common in dmesg output.
• Kernel log entries showing UCSI events with anomalous connector numbers exceeding the device's declared num_connectors value.
• Crashes or memory corruption events correlated with the insertion or operation of unfamiliar USB Type-C devices.

Detection Strategies

• Enable Kernel Address Sanitizer (KASAN) on test and pre-production systems to surface out-of-bounds accesses in the UCSI driver path.
• Monitor kernel ring buffers for ucsi subsystem warnings and compare reported connector indices against the platform's hardware connector count.
• Audit USB device connection events using udev and kernel auditing to identify unexpected Type-C devices on sensitive systems.

Monitoring Recommendations

• Forward kernel logs and audit data to a centralized logging or SIEM platform for correlation across hosts.
• Track Linux kernel versions across the fleet and flag hosts running unpatched releases that include the vulnerable ucsi_notify_common() code path.
• Alert on repeated UCSI driver errors or kernel crashes localized to USB Type-C operations as a signal of probing or exploitation attempts.

How to Mitigate CVE-2026-31729

Immediate Actions Required

• Apply the upstream stable kernel patches that add the bounds check in ucsi_notify_common() to all affected systems.
• Identify all Linux hosts running affected kernel versions, prioritizing laptops, workstations, and developer endpoints with USB Type-C ports.
• Restrict physical access to systems that cannot be patched immediately, since exploitation requires a local USB Type-C connection.

Patch Information

The Linux kernel maintainers have released fixes across stable branches. The patch validates the connector number against the allocated connector array before it is used as an index. Reference the upstream commits:

• Kernel Git Commit 98429e9
• Kernel Git Commit d2d8c17
• Kernel Git Commit f4e608f
• Kernel Git Commit f6dcbf2

Distribution maintainers (Debian, Ubuntu, Red Hat, SUSE) typically incorporate these stable patches into their kernel updates. Confirm the running kernel includes the fix using uname -r and verify against your distribution's security advisory.

Workarounds

• Disable the ucsi kernel module (modprobe -r typec_ucsi_acpi or equivalent) on systems where USB Type-C Power Delivery features are not required.
• Enforce USB device control policies that block unknown or untrusted USB Type-C peripherals using tools such as USBGuard.
• Limit physical access to USB Type-C ports through hardware port blockers or chassis lockdown on high-value endpoints.

# Verify running kernel version and check for UCSI module
uname -r
lsmod | grep ucsi

# Temporarily unload UCSI modules where Type-C PD is not needed
sudo modprobe -r typec_ucsi_acpi
sudo modprobe -r typec_ucsi

# Example USBGuard policy snippet to block unknown Type-C devices
# /etc/usbguard/rules.conf
allow id 1d6b:* # allow specific known vendor
block