CVE-2026-63960: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63960 Overview

CVE-2026-63960 is an out-of-bounds write vulnerability in the Linux kernel usb: typec: wcove driver. The flaw exists in wcove_read_rx_buffer(), which copies the USB Power Delivery (PD) RX FIFO into a caller-supplied struct pd_message without bounding the loop to the destination size. A malicious USB Type-C port partner can transmit a 31-byte PD frame and drive the loop one byte past the 30-byte destination structure. A secondary issue arises because regmap_read() writes a full unsigned int (four bytes) per iteration, so the final iteration overwrites three additional bytes on the IRQ thread's kernel stack in wcove_typec_irq().

Critical Impact
A malicious USB Type-C peer can trigger a kernel stack out-of-bounds write on affected Whiskey Cove PMIC systems, enabling potential memory corruption from a physically attached device.

Affected Products

Linux kernel usb: typec: wcove driver (Intel Whiskey Cove PMIC USB Type-C controller)
Multiple stable kernel branches referenced in the fix commits
Systems using Intel Whiskey Cove PMIC-based USB PD hardware

Discovery Timeline

2026-07-19 - CVE-2026-63960 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63960

Vulnerability Analysis

The vulnerability resides in wcove_read_rx_buffer() in the Whiskey Cove USB Type-C driver. The function reads bytes from the PD RX FIFO into a struct pd_message using a loop bounded by USBC_RXINFO_RXBYTES(info). This macro extracts a 5-bit field with a maximum value of 31. The destination struct pd_message is only 30 bytes, consisting of a __le16 header followed by __le32 payload[PD_MAX_PAYLOAD] in packed layout. When a port partner transmits a 31-byte frame, the loop writes past the end of the destination buffer if the hardware receiver does not enforce the PD object-count limit.

Root Cause

Two compounding defects create the out-of-bounds write. First, the loop bound is trusted input derived from hardware registers reflecting attacker-controlled wire data, and it exceeds the destination structure size. Second, regmap_read() takes an unsigned int * and stores a full four-byte value at each destination address, even though val_bits is 8. The high three bytes of each write are normally overwritten by the next iteration, but the final iteration leaves three trailing zero bytes past the buffer. With RXBYTES == 30, the i == 29 iteration already writes three zero bytes beyond msg, which is allocated on the IRQ thread's kernel stack in wcove_typec_irq(). This matches the pattern of [CWE-787] out-of-bounds write.

Attack Vector

Exploitation requires a malicious or malfunctioning USB Type-C port partner physically connected to a system using the Whiskey Cove USB PD controller. The attacker crafts a PD frame with an over-length payload to inflate the RXBYTES field beyond the 30-byte destination. When wcove_typec_irq() handles the receive interrupt, wcove_read_rx_buffer() copies the frame into a stack-allocated struct pd_message, writing past its bounds and corrupting adjacent stack memory in the IRQ thread. The upstream fix clamps the loop to sizeof(struct pd_message) and reads each register into a local variable before storing only its low byte into the destination.

Detection Methods for CVE-2026-63960

Indicators of Compromise

Unexpected kernel panics, stack traces, or oops messages referencing wcove_read_rx_buffer or wcove_typec_irq
Kernel stack corruption warnings such as Kernel stack guard page was hit on systems with Whiskey Cove USB PD hardware
Anomalous USB Type-C disconnect or renegotiation events immediately preceding kernel instability

Detection Strategies

Inventory Linux hosts using Intel Whiskey Cove PMIC hardware and confirm loaded typec_wcove module version against patched kernel builds
Enable kernel stack protection features such as CONFIG_STACKPROTECTOR_STRONG and KASAN in test environments to surface out-of-bounds writes during fuzzing
Monitor dmesg and journal logs for repeated PD renegotiation or driver faults correlating with USB device connect events

Monitoring Recommendations

Ship kernel logs and USB subsystem events to a centralized log platform and alert on driver crash signatures
Track USB Type-C port partner connection events on sensitive hosts and correlate with kernel warnings
Enforce endpoint policies restricting attachment of untrusted USB devices to systems handling sensitive data

How to Mitigate CVE-2026-63960

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits, including 3f9d50c8b02b4af0646aa892465080f9061fc89c and related fixes
Update to a distribution kernel that incorporates the wcove_read_rx_buffer() bounds clamp
Restrict physical access to USB Type-C ports on affected systems until patched

Patch Information

The fix clamps the copy loop to sizeof(struct pd_message) and reads each USBC_RX_DATA register into a local unsigned int before storing only its low byte into the destination. This ensures the copy cannot exceed the destination regardless of the value reported by RXINFO. Patch commits are available in the Linux stable tree, including Kernel Git Commit Fix, Kernel Git Commit Patch, and additional backports referenced in the NVD entry.

Workarounds

Disable or unload the typec_wcove kernel module on affected systems where USB PD is not required
Physically block or disable USB Type-C ports on hosts that cannot be patched immediately
Enforce USB device allow-listing via USBGuard or equivalent to prevent unknown Type-C peers from establishing PD sessions

bash

# Unload the vulnerable driver until the patched kernel is deployed
sudo modprobe -r typec_wcove

# Prevent automatic reload at boot
echo "blacklist typec_wcove" | sudo tee /etc/modprobe.d/blacklist-typec-wcove.conf
sudo update-initramfs -u