Linux Kernel CVE-2026-31729

Requires local authenticated access (PR:L) to the Linux system and ability to connect or control a USB Type-C device. Exploitation specifically requires that the system has active UCSI driver support (ucsi_acpi or platform-specific UCSI modules loaded) and at least one USB Type-C port managed through UCSI firmware interface. The vulnerable code path is triggered when hardware sends a CCI notification with connector number exceeding the actual connector count reported during driver initialization, which can occur through: (1) physically connecting a malicious USB-C device with custom firmware designed to send invalid CCI messages, or (2) compromising platform firmware (BIOS/UEFI/BMC) that mediates UCSI communication between hardware and OS driver. Attack complexity is low (AC:L) once these prerequisites are met - no race conditions or complex timing requirements exist. User interaction is not required (UI:N). Exploitation is limited to systems using kernel versions 5.5 through unpatched 6.x series where UCSI support exists; older kernels without UCSI and properly patched kernels are not vulnerable. Physical access control and trusted USB-C peripheral sources significantly limit real-world exploitation risk.

Real-world risk is moderate despite the high CVSS 7.8 base score. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local attack requiring authenticated access with low complexity, limiting remote exploitation scenarios. The EPSS score of 0.02% (5th percentile) suggests extremely low probability of mass exploitation in the wild, and CISA KEV does not list this vulnerability, confirming no observed active exploitation. However, the technical impact is severe (C:H/I:H/A:H) - successful exploitation grants arbitrary memory access in kernel context, potentially enabling privilege escalation, information disclosure, or denial of service. The attack requires either physical access to connect a malicious USB-C device or prior compromise of system firmware/BMC to inject crafted CCI messages, significantly raising the exploitation barrier. For organizations using Linux systems with USB Type-C ports (laptops, modern servers, embedded systems), the risk is real but constrained to scenarios where attackers already have local presence or can introduce malicious hardware. The availability of vendor patches across multiple stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0) and the straightforward fix (simple bounds check) make remediation practical. Priority should be elevated for environments with untrusted physical access (shared workstations, kiosks, labs) or where USB-C docking stations from unverified sources are common.

An attacker with physical access connects a malicious USB-C device (such as a modified docking station or custom hardware) to a vulnerable Linux system. The device's firmware sends a crafted UCSI CCI message with connector number field set to 120 (far exceeding the typical 2-4 connector array allocation). The kernel's ucsi_notify_common() function extracts this value and passes it to ucsi_connector_change(), which performs an out-of-bounds read/write at &ucsi->connector[120]. By carefully controlling the out-of-bounds offset and leveraging knowledge of kernel memory layout (obtainable via other info leaks), the attacker overwrites adjacent kernel structures to hijack control flow and execute arbitrary code with kernel privileges, achieving full system compromise.