Linux Kernel CVE-2026-31729

Upgrade to patched Linux kernel versions: 6.12.81 or later for 6.12.x series, 6.18.22 or later for 6.18.x series, 6.19.12 or later for 6.19.x series, or mainline 7.0 or later. Patch commits available at https://git.kernel.org/stable/c/f6dcbf2b024d55549959402f1db6c614e51d52cb (mainline), https://git.kernel.org/stable/c/f4e608fe12b7ac6a4a57176ab0296bb5a110a078, https://git.kernel.org/stable/c/98429e9ec89a5e3a204112dfaa2dbe6ca28493a0, and https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186 for backports. The fix adds a simple bounds check (if connector_num >= ucsi->cap.num_connectors) in ucsi_notify_common() before indexing the connector array. If immediate patching is not feasible, consider these compensating controls with trade-offs: (1) Blacklist the ucsi_acpi kernel module via modprobe configuration to prevent UCSI driver loading, which disables USB Type-C functionality including DisplayPort Alt Mode, Power Delivery negotiation, and USB-C port management - acceptable only if USB-C features are not business-critical; (2) Implement USB device whitelisting via USBGuard or similar tools to block unauthorized USB-C device connections, reducing malicious hardware attack surface but requiring ongoing policy maintenance and potentially impacting user productivity; (3) Disable Thunderbolt/USB4 in BIOS/UEFI if not required, as these protocols share the USB-C physical layer and may exercise the vulnerable code path, though this does not protect against malicious firmware scenarios. Note that compensating controls do not address firmware-based attack vectors where compromised BMC or system firmware could inject malicious CCI messages directly.