CVE-2026-63958: Linux Kernel UCSI Privilege Escalation

CVE-2026-63958 Overview

CVE-2026-63958 is a Linux kernel vulnerability in the USB Type-C Connector System Software Interface (UCSI) subsystem. The ucsi_connector_change() function uses a 7-bit connector number field from a UCSI Command Completion Indication (CCI) notification to index the ucsi->connector[] array without validating the value against the number of connectors reported by the Platform Policy Manager (PPM) at initialization. A buggy or malicious PPM, such as embedded controller (EC) firmware or an I2C-attached UCSI controller on the ccg, stm32g0, or glink transports, can trigger schedule_work() on memory past the end of the array. The fix rejects connector numbers that are zero or exceed cap.num_connectors before array dereference.

Critical Impact
An attacker-controlled or malfunctioning UCSI PPM can drive out-of-bounds memory access in the Linux kernel, leading to memory corruption or denial of service on affected systems.

Affected Products

Linux kernel versions containing the vulnerable ucsi_connector_change() code path in drivers/usb/typec/ucsi/
Systems using UCSI transports including ccg, stm32g0, and glink
Devices with I2C-attached UCSI controllers or EC firmware acting as PPM

Discovery Timeline

2026-07-19 - CVE-2026-63958 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63958

Vulnerability Analysis

The vulnerability resides in the UCSI subsystem in the Linux kernel, which handles USB Type-C connector state changes reported by a Platform Policy Manager. When the PPM issues a CCI notification, the kernel reads a 7-bit connector number field and uses it directly to index the ucsi->connector[] array. This array is sized according to cap.num_connectors, the connector count reported by the PPM during initialization.

Because the notification path performs no bounds check, any connector number between the initialized count and 127 dereferences memory beyond the array. The kernel then calls schedule_work() on the resulting invalid pointer, queuing a work item against attacker-influenced memory. This is classified as an out-of-bounds read/write [CWE-125/CWE-787] in kernel context.

Root Cause

The root cause is missing input validation on data supplied by a lower-trust firmware component. The UCSI driver treats the PPM as fully trusted despite the PPM often being external hardware, such as an I2C device or EC firmware, that can behave incorrectly or be compromised. The fix validates that the connector number is non-zero and does not exceed cap.num_connectors prior to indexing ucsi->connector[].

Attack Vector

Exploitation requires a PPM capable of sending crafted CCI notifications. On systems where the PPM is implemented as an I2C-attached controller (ccg, stm32g0) or a firmware component reachable over glink, a compromised or malicious firmware image can trigger the flaw. The out-of-bounds access occurs in kernel context, so the impact ranges from kernel panic to potential memory corruption depending on adjacent heap contents.

No public proof-of-concept exploit code is available. Consult the upstream commits referenced below for the exact code paths involved.

Detection Methods for CVE-2026-63958

Indicators of Compromise

Unexpected kernel warnings, oopses, or panics originating from drivers/usb/typec/ucsi/ucsi.c, particularly around ucsi_connector_change() or work queue scheduling.
Kernel log entries showing UCSI CCI notifications with connector numbers exceeding the reported num_connectors value.
Anomalous USB Type-C connector state transitions reported by systems using ccg, stm32g0, or glink UCSI transports.

Detection Strategies

Monitor dmesg and journald for UCSI driver warnings, KASAN reports, or slab-out-of-bounds messages referencing the UCSI subsystem.
Compare running kernel versions against distribution security bulletins referencing commits 0edd1e21587b, 156b6f0aec61, 288a81a85070, 5af2719b460a, bd24d92af4ae, and cea949203fae.
Enable kernel hardening features such as KASAN or KFENCE in test environments to surface out-of-bounds accesses in the UCSI code path.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on repeated UCSI faults or work queue scheduling errors.
Track firmware versions for embedded controllers and I2C UCSI controllers across the fleet to identify unpatched or untrusted PPM implementations.
Include UCSI-affected drivers in vulnerability scan baselines and periodically validate kernel patch levels on laptops and embedded devices using USB Type-C.

How to Mitigate CVE-2026-63958

Immediate Actions Required

Apply the vendor-provided kernel update that incorporates the upstream fixes referenced in the Linux Kernel Commit 0edd1e21587b and related patches.
Inventory systems that expose UCSI transports (ccg, stm32g0, glink) and prioritize patching devices with externally updatable PPM firmware.
Restrict physical and firmware-update access to embedded controllers and I2C-attached UCSI devices that act as PPM.

Patch Information

The fix is available in the mainline and stable Linux kernel trees through the following commits: Linux Kernel Commit 0edd1e21587b, Linux Kernel Commit 156b6f0aec61, Linux Kernel Commit 288a81a85070, Linux Kernel Commit 5af2719b460a, Linux Kernel Commit bd24d92af4ae, and Linux Kernel Commit cea949203fae. The patch adds a bounds check that rejects connector numbers that are zero or exceed cap.num_connectors in ucsi_connector_change().

Workarounds

Unload the UCSI driver modules (ucsi_ccg, ucsi_stm32g0, ucsi_glink, typec_ucsi) on systems that do not require USB Type-C policy management until a patched kernel is deployed.
Ensure PPM firmware is sourced from trusted vendors and validated during boot to reduce the risk of malicious CCI notifications.
Where feasible, disable USB Type-C alternate mode negotiation in firmware settings to limit PPM activity on high-risk endpoints.

bash

# Verify installed kernel version and confirm the UCSI fix is present
uname -r

# Temporarily unload UCSI modules on unpatched systems
sudo modprobe -r ucsi_ccg ucsi_stm32g0 ucsi_glink typec_ucsi

# Blacklist UCSI modules until patched kernel is deployed
echo 'blacklist typec_ucsi' | sudo tee /etc/modprobe.d/blacklist-ucsi.conf