CVE-2026-63959 Overview
CVE-2026-63959 is a Linux kernel vulnerability in the USB Type-C Port Manager (TCPM) driver for the Maxim TCPCI chipset. The flaw resides in the tcpm/tcpci_maxim module, which handles Power Delivery (PD) message parsing. A malicious or malfunctioning USB Type-C port can transmit a CRC-valid frame whose header advertises up to seven data objects, while the frame body carries fewer than that count. The driver previously trusted the header without validating it against RX_BYTE_CNT, leading to reads from uninitialized stack memory. The vulnerability was published on July 19, 2026 and is tracked with an EPSS probability of 0.2%.
Critical Impact
An attacker with physical access to a USB Type-C port can send crafted PD messages that cause the kernel to read uninitialized stack memory, potentially leaking sensitive kernel data.
Affected Products
- Linux kernel — drivers/usb/typec/tcpm/tcpci_maxim (Maxim TCPCI driver)
- Linux kernel branches referenced in the upstream stable commits
- Systems using the Maxim USB Type-C Port Controller Interface hardware
Discovery Timeline
- 2026-07-19 - CVE-2026-63959 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63959
Vulnerability Analysis
The vulnerability affects the Type-C Port Manager (TCPM) driver's handling of USB Power Delivery (PD) messages received through the Maxim Type-C Port Controller Interface (TCPCI). PD messages contain a header field that indicates the Number of Data Objects (NDO), which can be up to seven. The driver used this header-advertised NDO value to determine how many data objects to process from the receive buffer.
When a peer port transmits a CRC-valid frame whose header advertises more data objects than the body actually contains, the driver processes data objects that were never written into the receive buffer. This results in reads from uninitialized stack memory. The fix adds a validation step that compares the header's advertised NDO count against the actual RX_BYTE_CNT and rejects malformed messages.
Root Cause
The root cause is missing input validation [CWE-20] combined with uninitialized memory use. The driver trusted attacker-controllable header metadata without cross-checking it against the authoritative byte count register RX_BYTE_CNT. This allowed the parser's iteration bound to exceed the amount of data actually present.
Attack Vector
Exploitation requires the ability to send crafted PD frames to a target's USB Type-C port. This is typically a physical attack vector, achieved by connecting a malicious cable, dock, charger, or another USB-C device that acts as a broken or malicious Type-C port partner. The frame must pass CRC validation but declare an inflated NDO in its header. See the upstream fix commit for the exact validation logic added.
No public exploit code is available for CVE-2026-63959, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-63959
Indicators of Compromise
- Unexpected kernel log entries from the tcpci_maxim or tcpm modules referencing malformed PD messages
- Kernel warnings, oops, or stack traces originating from PD message processing paths
- Unusual USB Type-C connection events involving unrecognized cables, docks, or chargers on affected hosts
Detection Strategies
- Inventory Linux hosts running affected kernel versions with the Maxim TCPCI driver loaded (lsmod | grep tcpci_maxim)
- Monitor dmesg and journal output for TCPM parsing errors and repeated PD message rejections
- Correlate USB Type-C hotplug events with unexpected kernel warnings on endpoints and embedded devices
Monitoring Recommendations
- Ship kernel logs from Linux endpoints to a centralized logging or SIEM platform for anomaly review
- Alert on tcpm-related kernel warnings from user-facing laptops and Chromebook-class hardware
- Track deployment of the fixed kernel builds against the affected host inventory to confirm remediation coverage
How to Mitigate CVE-2026-63959
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD advisory to all affected systems
- Prioritize patching for laptops, tablets, and embedded Linux devices exposing USB Type-C ports to untrusted peripherals
- Restrict use of untrusted USB Type-C cables, docks, and chargers on sensitive hosts until patches are deployed
Patch Information
The fix validates the PD message header's NDO against RX_BYTE_CNT before iterating over data objects, rejecting frames that advertise more objects than the body contains. The patch is available across multiple stable branches through the following commits: 0af00f1459f5, 9b496e3371c0, aa2f716327be, c4ab8e2d4432, and dc17721d42e6. Update to a distribution kernel that incorporates these commits.
Workarounds
- Enforce organizational policy prohibiting the connection of untrusted USB Type-C peripherals to affected hosts
- Where feasible, disable or unload the tcpci_maxim module on systems that do not require USB-C Power Delivery functionality
- Use USB port control features such as USBGuard to restrict which USB devices may attach to the system
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
