CVE-2026-63961

A flaw was found in the Linux kernel's USB Type-C DisplayPort (DP) alternate mode. A malicious or improperly configured USB-C device can send a malformed status update Vendor Defined Object (VDO), which is a data structure used for communication. This can cause the kernel to read uninitialized memory from the stack and transmit this sensitive data, leading to information disclosure. This vulnerability allows an attacker with physical access to a malicious USB-C device to potentially gain access to sensitive system information.

A malicious or malformed USB Type-C DisplayPort Alt Mode device can send a Status Update VDO with an invalid object count, causing the kernel to read uninitialized stack data and send it outside the local stack context. This is an information disclosure issue rather than a memory corruption or crash issue. For the CVSS the PR:N value is used for the paranoid score because no local account or kernel privilege is required once the attacker can present the malicious Type-C device to the target. The issue is not network reachable and requires physical or local device access, typically through a malicious dock, adapter, cable, or directly attached USB-C partner. Impact is confidentiality loss, with no direct integrity or availability impact supported by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.