CVE-2026-63963: Linux Kernel Information Disclosure Flaw

CVE-2026-63963 Overview

CVE-2026-63963 is a Linux kernel vulnerability in the USB Type-C Port Manager (TCPM) subsystem. The flaw resides in the Discover Identity acknowledgment handlers svdm_consume_identity() and svdm_consume_identity_sop_prime(). These functions accept a Vendor Defined Object (VDO) count value supplied by the attached USB device without proper bounds validation. A device-controlled count value can index past the end of static arrays inside the kernel, leaking adjacent kernel memory to the malicious peripheral.

Critical Impact
A malicious or malformed USB Type-C device can trigger out-of-bounds reads in Linux kernel memory by supplying a crafted VDO count during USB Power Delivery Discover Identity negotiation, potentially leaking sensitive kernel data.

Affected Products

Linux kernel — USB Type-C Port Manager (TCPM) subsystem (drivers/usb/typec/tcpm/)
Kernel builds prior to the fixes referenced in commits 569f797, 8fbc349, ed8649f, and f9d787f
Systems exposing USB Type-C ports with USB Power Delivery Structured VDM support

Discovery Timeline

2026-07-19 - CVE-2026-63963 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63963

Vulnerability Analysis

The Linux kernel's TCPM driver implements USB Power Delivery (USB PD) Structured Vendor Defined Messages (SVDM). When a USB Type-C partner responds to a Discover Identity request, the local port receives a set of Vendor Defined Objects (VDOs) whose count is encoded in the response header. The kernel handlers svdm_consume_identity() and svdm_consume_identity_sop_prime() copy VDO entries into fixed-size arrays inside the struct pd_mode_data and struct partner_identity structures.

Because the count is controlled by the connected device and was consumed without proper validation, a crafted peer can specify a count larger than the destination buffer. The result is an out-of-bounds read [CWE-125] from kernel memory adjacent to the identity structures. Data read out of bounds may then be stored in kernel state that is later exposed to userspace via sysfs attributes describing the connected partner, effectively leaking kernel memory across a physical hardware boundary.

Root Cause

The root cause is missing input validation. The VDO count field originating from the USB PD partner was trusted implicitly and used as an array index into static structures without a bounds check against the destination array size. This is a classic input validation error in a kernel data path exposed to untrusted external hardware.

Attack Vector

Exploitation requires an attacker-controlled USB Type-C device or cable capable of participating in USB PD SVDM exchanges. When such a device is connected to a vulnerable Linux host, it responds to Discover Identity or Discover Identity SOP' requests with a header containing an oversized VDO count. TCPM then processes the response, reading past the intended array bounds. The primary impact is information disclosure; specific data exposure depends on kernel heap or object layout adjacent to the identity buffers.

No verified public exploit code is available. Refer to the upstream kernel commits for the exact validation added to reject malformed counts.

Detection Methods for CVE-2026-63963

Indicators of Compromise

Unexpected USB Type-C device attachments logged in dmesg or journalctl -k referencing tcpm or typec subsystems
Kernel messages from the tcpm driver related to Discover Identity handling with unusual VDO counts
Presence of unfamiliar USB PD partners in /sys/class/typec/port*-partner/identity/

Detection Strategies

Audit installed kernel versions against distribution advisories referencing commits 569f7971542e, 8fbc349e8383, ed8649f3822e, and f9d787fbe831
Monitor kernel logs for anomalies from the tcpm and typec drivers, particularly around SVDM parsing
Track USB Type-C partner enumeration events on endpoints that handle sensitive data, such as engineering laptops and lab hosts

Monitoring Recommendations

Enable auditd rules to record USB device insertion events on Linux endpoints
Forward kernel logs to a centralized log platform and alert on repeated TCPM parser warnings
Inventory endpoints with USB Type-C USB PD support and correlate kernel patch level with hardware exposure

How to Mitigate CVE-2026-63963

Immediate Actions Required

Apply the stable kernel updates that include commits 569f7971542eb10025d8a0989b83f28a29d8ba20, 8fbc349e8383125dd2d8de1c1e926279d398ab17, ed8649f3822e211d025bcab5158af6f8a38c8705, and f9d787fbe83127105e42088cca40e5118db0d810
Restrict physical access to USB Type-C ports on high-value systems and enforce USB port control policies
Disable USB Type-C alternate mode and USB PD data role swapping on systems that do not require them

Patch Information

Upstream fixes add explicit bounds checks on the VDO count before indexing the identity arrays in svdm_consume_identity() and svdm_consume_identity_sop_prime(). Consult the following references for patch details: Kernel Git Commit 569f797, Kernel Git Commit 8fbc349, Kernel Git Commit ed8649f, and Kernel Git Commit f9d787f. Rebuild and reboot after installing the updated kernel package.

Workarounds

Use USB port blockers or endpoint policy tools to prevent connection of untrusted USB Type-C devices
Unload the TCPM driver stack (tcpm, vendor-specific TCPCI drivers) on servers where USB PD is not required
Configure USB device authorization via /sys/bus/usb/devices/*/authorized to require explicit approval before enumeration

bash

# Verify running kernel and check for TCPM module presence
uname -r
lsmod | grep -E 'tcpm|typec'

# Require explicit authorization for new USB devices
echo 0 | sudo tee /sys/bus/usb/devices/usb*/authorized_default

# Optional: prevent tcpm from loading on systems that do not need USB PD
echo 'blacklist tcpm' | sudo tee /etc/modprobe.d/blacklist-tcpm.conf