CVE-2026-63959

kernel: usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT

Loading…

Severity

Unknown

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · July 19, 2026

Updated · August 7, 2026

Description

A flaw was found in the Linux kernel's USB Type-C (Universal Serial Bus Type-C) subsystem. A malicious or broken USB-C port can transmit a specially crafted data frame that advertises more data objects than it actually contains. This can lead to the system reading from uninitialized memory, potentially disclosing sensitive information or causing system instability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-130 · Improper Handling of Length Parameter Inconsistency