CVE-2026-63964 Overview
CVE-2026-63964 is a NULL pointer dereference vulnerability in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) driver for Cypress CCGx controllers. The flaw resides in the do_flash() function within the usb: typec: ucsi: ccg component, which parses .cyacd firmware images during firmware update operations.
When a firmware image lacks the expected ':' record header, strnchr() returns NULL. The kernel then treats the NULL as a pointer lower than eof and enters the parsing loop with p + 1 == (void *)1, triggering a kernel oops.
Critical Impact
A local root user who can stage a crafted firmware file under /lib/firmware and write to the do_flash sysfs attribute can crash the kernel, resulting in denial of service.
Affected Products
- Linux kernel versions containing the drivers/usb/typec/ucsi/ucsi_ccg.c driver
- Systems using Cypress CCGx USB Type-C controllers with UCSI
- Multiple stable branches, per the referenced git.kernel.org fix commits
Discovery Timeline
- 2026-07-19 - CVE-2026-63964 published to the National Vulnerability Database (NVD)
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63964
Vulnerability Analysis
The vulnerability is a NULL pointer dereference [CWE-476] in the CCGx firmware flashing routine. The do_flash() function attempts to locate the first .cyacd record header using p = strnchr(fw->data, fw->size, ':'). It then enters a loop that scans subsequent records with s = strnchr(p + 1, eof - p - 1, ':').
When the firmware blob contains no ':' byte, the initial strnchr() call returns NULL. Because NULL compares less than the valid eof kernel pointer, the loop condition p < eof evaluates true. The loop body then invokes strnchr() with p + 1 equal to (void *)1 and a length approximating (unsigned long)eof, producing an out-of-bounds read and kernel oops.
The not_signed_fw fallthrough earlier in do_flash() combined with chip-state branches in ccg_fw_update_needed() permit an unsigned firmware blob to reach the vulnerable loop without validation.
Root Cause
The root cause is missing input validation on the result of strnchr(). The code assumed the firmware image would always contain at least one ':' delimiter and did not check for a NULL return before pointer arithmetic. The patch bails out with -EINVAL when the initial strnchr() returns NULL.
Attack Vector
Exploitation requires local root privileges. An attacker with root access places a crafted firmware file lacking the ':' byte under /lib/firmware and then writes to the do_flash sysfs attribute exposed by the ucsi_ccg driver. The malformed blob passes upstream signature-optional checks and reaches the vulnerable parser, causing a kernel oops and denial of service. See the Kernel Git Commit Update 1 for the upstream fix.
Detection Methods for CVE-2026-63964
Indicators of Compromise
- Kernel oops messages referencing ucsi_ccg, do_flash, or strnchr in dmesg or /var/log/kern.log
- Unexpected write activity to the do_flash sysfs attribute under /sys/class/typec/
- Presence of unsigned or malformed .cyacd firmware files under /lib/firmware
Detection Strategies
- Audit kernel logs for panics or oops signatures within the UCSI CCG driver stack
- Monitor filesystem changes to /lib/firmware for unexpected .cyacd file drops by non-package-manager processes
- Track root-level writes to typec sysfs entries and correlate against legitimate firmware update workflows
Monitoring Recommendations
- Enable auditd rules on /lib/firmware and typec sysfs paths to log writes with process context
- Alert on kernel crash telemetry originating from drivers/usb/typec/ucsi/ucsi_ccg.c
- Correlate root shell activity with firmware directory modifications across the fleet
How to Mitigate CVE-2026-63964
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the git.kernel.org commits for the ucsi_ccg driver
- Restrict root access on systems exposing USB Type-C UCSI CCG hardware to trusted administrators only
- Verify integrity of .cyacd firmware images shipped in /lib/firmware against vendor-provided hashes
Patch Information
The fix adds a NULL check after the initial strnchr() call in do_flash() and returns -EINVAL when no ':' record header is found. Patches are available across multiple stable branches: commit 2f395ca1, commit 3f432b82, commit 6526f868, commit a38ed878, commit b41dfc03, commit c4ee519b, commit c8460de5, and commit d7486952.
Workarounds
- Blacklist the ucsi_ccg kernel module on systems that do not require Cypress CCGx USB Type-C support
- Enforce strict file integrity monitoring on /lib/firmware to prevent placement of crafted firmware blobs
- Limit privileged access and audit any user with root or CAP_SYS_ADMIN capabilities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
