CVE-2026-63958

A flaw was found in the Linux kernel's USB Type-C subsystem. This vulnerability allows a malicious or buggy Power Delivery Microcontroller (PPM), such as embedded controller (EC) firmware or an I2C-attached Universal Serial Bus (USB) Type-C Connector System Interface (UCSI) controller, to provide an invalid connector number. This invalid number is then used to access memory beyond the intended array boundaries, which can lead to a system crash. The primary consequence is a denial of service, making the system unavailable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.