CVE-2026-64330: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64330 Overview

CVE-2026-64330 is an out-of-bounds read vulnerability in the Linux kernel's USB Type-C Port Manager (TCPM) subsystem. The flaw resides in the svdm_consume_modes() function within the USB Power Delivery (PD) alternate mode discovery path. The function reads the Standard or Vendor ID (SVID) value from pmdata->svids using pmdata->svid_index as an array index without validating the index against pmdata->nsvids. A malicious USB Type-C partner can drive svid_index beyond SVID_DISCOVERY_MAX (16) and cause the kernel to read into adjacent fields of the embedded pd_mode_data structure inside struct tcpm_port.

Critical Impact
A malicious USB Type-C partner device can inject an attacker-chosen SVID that gets registered via typec_partner_register_altmode(), enabling arbitrary alternate-mode registration on the host.

Affected Products

Linux kernel USB Type-C Port Manager (TCPM) driver
Systems with USB Type-C ports exposing USB Power Delivery alternate mode discovery
Multiple stable kernel branches receiving backported fixes across the referenced commits

Discovery Timeline

2026-07-25 - CVE-2026-64330 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64330

Vulnerability Analysis

The vulnerability lies in the USB Type-C Port Manager code path that consumes SVDM (Structured Vendor Defined Message) Discover Modes responses from a connected partner. In svdm_consume_modes(), the kernel executes:

paltmode->svid = pmdata->svids[pmdata->svid_index];

No check ensures that svid_index is within the bounds of the populated svids array. Because struct pd_mode_data is embedded directly inside struct tcpm_port, indexing past the svids array causes reads into adjacent fields of the parent structure.

At index 16, the read lands on the altmodes count field. At index 18 and beyond, the read enters altmode_desc[], which stores VDOs (Vendor Defined Objects) supplied by the untrusted USB partner. This gives the partner direct control over data that will subsequently be treated as a valid SVID.

Root Cause

The root cause is missing input validation [CWE-125] on the svid_index field before it is used as an array subscript. The kernel trusts values driven by the negotiation state machine without confirming that svid_index >= 0 and svid_index < pmdata->nsvids. This classifies the flaw as an out-of-bounds read within a kernel driver.

Attack Vector

Exploitation requires physical or logical access to a USB Type-C port on the target system. A malicious or compromised USB Type-C partner responds to Discover SVIDs and Discover Modes messages in a crafted sequence that advances svid_index to 20. The partner also injects a chosen SVID value into altmode_desc[0].vdo. When svdm_consume_modes() executes with the out-of-bounds index, paltmode->svid is loaded with the partner-controlled SVID. The kernel then calls typec_partner_register_altmode() with this attacker-selected identifier, enabling registration of alternate modes that the partner did not legitimately advertise.

The upstream fix validates that pmdata->svid_index is non-negative and strictly less than pmdata->nsvids before dereferencing the svids array.

Detection Methods for CVE-2026-64330

Indicators of Compromise

Kernel log messages from the tcpm subsystem showing unexpected or unknown SVID values being registered for a connected USB Type-C partner
Repeated USB Type-C connection or renegotiation events from a single peripheral within short windows
Registration of alternate modes that do not match the physical class of the attached device

Detection Strategies

Monitor dmesg and journald for typec and tcpm events, particularly typec_partner_register_altmode calls with anomalous SVIDs
Correlate USB device attach events with subsequent alternate mode registrations to flag partners advertising more or unusual modes than expected
Track kernel version and patch state across the fleet to identify hosts still running vulnerable TCPM code

Monitoring Recommendations

Ingest kernel and udev logs into a centralized log platform for USB Type-C activity analysis
Alert on USB Type-C connections in high-security environments where peripheral policy restricts alternate mode use
Baseline expected SVIDs for approved peripherals and flag deviations for review

How to Mitigate CVE-2026-64330

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits 012406f, 313ca06, 3e1b1ac, 7b681dd, 89ff289, c6d2af3, d638ec1, and f8163c4
Update to distribution kernel packages that include the svdm_consume_modes() bounds check
Restrict physical access to USB Type-C ports on sensitive systems until patched

Patch Information

The fix adds validation that pmdata->svid_index is non-negative and strictly less than pmdata->nsvids before the array access in svdm_consume_modes(). Patched commits are available in the upstream stable trees. Refer to Kernel Git Commit 012406f, Kernel Git Commit 313ca06, Kernel Git Commit 3e1b1ac, Kernel Git Commit 7b681dd, Kernel Git Commit 89ff289, Kernel Git Commit c6d2af3, Kernel Git Commit d638ec1, and Kernel Git Commit f8163c4.

Workarounds

Disable or physically block USB Type-C ports on systems that cannot be patched immediately
Enforce USB device authorization policies (/sys/bus/usb/devices/*/authorized) to prevent untrusted USB Type-C partners from completing PD negotiation
In managed environments, apply USBGuard or equivalent policy engines to restrict which peripherals may attach

bash

# Verify running kernel version and confirm patch application
uname -r

# Deauthorize all USB devices by default until patched (systemd-udev example)
echo 0 | sudo tee /sys/bus/usb/devices/usb*/authorized_default

# Example USBGuard policy: block all, allow only known peripherals
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard