CVE-2026-63962: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63962 Overview

CVE-2026-63962 is an out-of-bounds write vulnerability in the Linux kernel's USB Type-C Port Manager (TCPM) subsystem. The flaw resides in svdm_consume_modes() within the USB Power Delivery Structured VDM (SVDM) discovery handling code. The function validates the pmdata->altmodes index against the altmode_desc[] array size only once before entering its processing loop, but fails to enforce the bound on each iteration. A malicious or malfunctioning USB Type-C port partner can supply crafted Discover Modes ACK responses to write attacker-controlled data past the end of altmode_desc[] into adjacent kernel memory, including the partner_altmode[] pointer array.

Critical Impact
A rogue USB Type-C partner device can corrupt kernel memory by driving altmodes to the array limit through normal SVID discovery, then delivering an extra Discover Modes ACK carrying seven VDOs to overflow the fixed-size altmode_desc[] buffer.

Affected Products

Linux kernel — USB Type-C Port Manager (drivers/usb/typec/tcpm/tcpm.c)
Linux kernel branches receiving the fix via stable commits 3389c149, 4505f33d, 845598b1, and cbad85b4
Systems using TCPM-managed USB Type-C ports with Power Delivery Alternate Mode support

Discovery Timeline

2026-07-19 - CVE-2026-63962 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63962

Vulnerability Analysis

The defect lies in the USB Type-C TCPM code path that processes Structured VDM (SVDM) Discover Modes responses. svdm_consume_modes() iterates over the Vendor Defined Objects (VDOs) returned by a port partner and stores them into altmode_desc[ALTMODE_DISCOVERY_MAX]. The function performs a single boundary check on pmdata->altmodes before entering the loop, then advances the index for every VDO consumed without re-validating it against ALTMODE_DISCOVERY_MAX.

Under well-behaved discovery this is safe because each of at most SVID_DISCOVERY_MAX SVIDs contributes at most MODE_DISCOVERY_MAX modes, exactly filling the descriptor array. The CMDT_RSP_ACK handler in tcpm_pd_svdm(), however, does not correlate an inbound ACK with any request the port actually issued. Once port->partner is set, any unsolicited Discover Modes ACK is consumed unconditionally, allowing a partner to send more mode data than the fixed array can hold.

Root Cause

The root cause is a missing per-iteration bounds check [CWE-787: Out-of-Bounds Write] combined with unauthenticated acceptance of unsolicited SVDM responses. A partner can legitimately push altmodes to ALTMODE_DISCOVERY_MAX - 1 through normal enumeration, then transmit one additional Discover Modes ACK containing seven VDOs. The pre-loop check passes, and the loop then writes up to five entries past altmode_desc[]. The next field in struct tcpm_port is the partner_altmode[] pointer array, which receives partner-chosen SVID and VDO bytes.

Attack Vector

Exploitation requires physical connection of a malicious or compromised USB Type-C device that speaks USB Power Delivery. The attacker device drives the SVDM discovery flow to the boundary, then emits a forged Discover Modes ACK with the maximum VDO count. The overflow corrupts adjacent kernel pointer storage in struct tcpm_port, giving the partner control over pointer values later dereferenced by mode_data_prime handling and related altmode logic. This enables kernel memory corruption and potential control-flow influence from an untrusted peripheral.

No public exploit code is available. The upstream fix moves the bound check inside the loop so the array cannot be indexed past ALTMODE_DISCOVERY_MAX regardless of partner-supplied VDO counts. See the Kernel Git Commit 3389c149 for the authoritative patch.

Detection Methods for CVE-2026-63962

Indicators of Compromise

Kernel Oops, general protection fault, or KASAN: slab-out-of-bounds reports referencing svdm_consume_modes or tcpm_pd_svdm in dmesg.
Unexpected USB Type-C alternate mode enumeration entries, or partner_altmode pointers containing values that do not correspond to legitimate SVIDs.
Repeated Discover Modes ACK packets logged by TCPM debug tracing without matching outbound Discover Modes requests.

Detection Strategies

Enable CONFIG_TYPEC_TCPM tracepoints and monitor for anomalous SVDM state transitions and unsolicited CMDT_RSP_ACK frames.
Run KASAN-instrumented kernels on test systems to catch the out-of-bounds write during USB Type-C fuzzing or peripheral connection.
Track kernel version and patch state across the fleet, correlating with USB Type-C hardware inventory to prioritize vulnerable hosts.

Monitoring Recommendations

Alert on kernel crashes originating from USB Type-C or Power Delivery code paths on production endpoints.
Log USB device connection events, including PD partner VID/PID, and flag unknown or newly seen Type-C peripherals attached to sensitive hosts.
Restrict and audit physical access to USB-C ports on servers, kiosks, and unattended workstations.

How to Mitigate CVE-2026-63962

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by stable commits 3389c149, 4505f33d, 845598b1, and cbad85b4 or install the vendor kernel update that includes them.
Reboot affected systems after patching to ensure the fixed tcpm code is loaded.
Inventory hosts with TCPM-backed USB Type-C ports and prioritize laptops, workstations, and edge devices exposed to untrusted peripherals.

Patch Information

The fix moves the ALTMODE_DISCOVERY_MAX bounds check inside the VDO processing loop in svdm_consume_modes(), preventing writes past altmode_desc[] regardless of partner behavior. Patches are available via the kernel.org stable tree at Kernel Git Commit 3389c149, Kernel Git Commit 4505f33d, Kernel Git Commit 845598b1, and Kernel Git Commit cbad85b4. Distribution maintainers will backport the change into supported LTS kernels.

Workarounds

Physically restrict connection of untrusted USB Type-C devices, particularly on high-value systems and shared endpoints.
Where feasible, disable USB Type-C Alternate Mode or Power Delivery support in firmware or udev policies until the kernel patch is deployed.
Use USB port data-blocking adapters or charge-only cables on kiosks and lab systems that only require power delivery.

bash

# Verify running kernel includes the fix (example for Debian/Ubuntu)
uname -r
apt-cache policy linux-image-$(uname -r)

# Block loading of the tcpm module where USB-C alt-mode is not required
echo 'blacklist tcpm' | sudo tee /etc/modprobe.d/disable-tcpm.conf
sudo update-initramfs -u