EUVD-2026-45732
GHSA-fwcg-qvj5-vv4j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttach malicious USB-C port partner
-
DeliverySend CRC-valid PD frame with inflated NDO header
-
ExploitDriver trusts header over RX_BYTE_CNT
-
ExecutionParse reads uninitialized kernel stack
-
ImpactInformation disclosure or undefined behavior
Vulnerability Assessment
| Exploitation Conditions | Requires a host running the Linux kernel USB Type-C stack with the Maxim TCPC driver (tcpm/tcpci_maxim) and a physically connected, attacker-controlled or broken USB-C Power Delivery port partner. The specific trigger is a CRC-valid PD message whose header advertises up to seven data objects (NDO count) while the body carries fewer, which before the fix was not validated against RX_BYTE_CNT. Limiting factors: exploitation is bounded to systems with Maxim TCPC hardware and this driver loaded; it needs direct USB-C attachment of a malicious device (physical proximity), not remote network reach; and the described effect is a bounded read of uninitialized stack memory rather than arbitrary code execution. Fixed in Linux 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1; updating the kernel is the remediation stated in the sources. |
| Impact | This is a low-to-moderate-severity local kernel flaw, not an emergency. The signals are internally consistent on priority but conflict on impact type. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:N/I:N/A:H, score 5.5) models a locally-reachable availability bug requiring low privileges, while the Tags and the description ('reading from uninitialized stack memory' when a Power Delivery header over-advertises data objects) point to an information-disclosure / uninitialized-memory-read condition - note the conflict: the vector encodes A:H with C:N/I:N, yet the only described behavior is reading uninitialized stack memory, which is characteristically an info-leak or undefined-behavior condition rather than a clean availability loss. EPSS is low (0.20%, 10th percentile) and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation; exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month' (routine patch cadence), consistent with the low EPSS and absence of KEV. Crucially, the real-world trigger requires an attacker-controlled or malfunctioning USB Type-C port partner physically attached to a host running the Maxim TCPC driver (tcpci_maxim) - the given AV:L undersells this; a malicious USB-C counterpart is closer to physical access than to arbitrary local software. Net: a legitimate maintenance-grade fix, far below the urgency a 'high CVSS' number alone might imply. |
| Exploit ScenarioDerived | An attacker connects a malicious or malfunctioning USB-C device (acting as a Power Delivery port partner) to a Linux system using the tcpm/tcpci_maxim driver, then transmits a CRC-valid PD frame whose header advertises up to seven data objects while the frame body actually carries fewer. The driver parses the advertised count and reads uninitialized kernel stack memory for the missing objects. No public exploit code or PoC reference is identified in the provided data; exploitation requires physical attachment of the rogue USB-C partner. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Kernel stack memory disclosure occurs in the Linux kernel USB Type-C Power Delivery path (tcpm together with the tcpci_maxim driver) when a CRC-valid PD message's header advertises more data objects than its body actually carries. The driver previously trusted the header NDO field without cross-checking it against RX_BYTE_CNT, so parsing such a frame read past the received data into uninitialized stack memory and could return those contents to the port partner. The practical exposure is narrow: a host must run this kernel stack on Maxim TCPC hardware and have a malicious or broken USB-C port partner physically attached, which is why NVD scored it 5.5 while a physical-vector reassessment lands lower; EPSS is only 0.20% (10th percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis.
RemediationAI
Vendor-released patches are available: update to Linux 6.6.143, 6.12.93, 6.18.35, 7.0.12 or 7.1, or install the equivalent distribution kernel carrying the fix such as Ubuntu's USN-8593-1. The upstream stable commits are 8a8cd4790b08c9f79ea2250b3bd933fd79f67e56, aa2f716327be1818e1cb156da8a2844804aaec2f, 0af00f1459f5dd757f0d392f8caa38039561ac62, dc17721d42e6d89f63572e63add8306a0e15eb3c, 9b496e3371c04f0a03b7faa5d2442536d00e3998 and c4ab8e2d4432abb646c5c0687f8dab173da901f9, and patches are best applied together with the rest of the stable release rather than backported alone. The sources state that updating the kernel is the remediation; because the trigger requires a physically attached malicious or broken USB-C port partner, exposure until the update is applied is limited to hosts that both load tcpci_maxim on Maxim TCPC hardware and permit untrusted devices to attach, so controlling physical access to those ports on such systems reduces the window. No fixed version beyond those listed and no non-kernel workaround is described in the available sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Linux USB Type-C Port Manager (TCPM) implements the Power Delivery state machine on top of a Type-C Port Controller Interface (TCPCI) driver; tcpci_maxim is the TCPCI driver for Maxim TCPC chips. In USB-PD, every message begins with a 16-bit header whose Number of Data Objects (NDO) field, bits 12-14, declares how many 32-bit data objects follow, up to the protocol maximum of seven. The receiver must reconcile that declared count with RX_BYTE_CNT, the register value describing how many bytes were actually written into the receive FIFO. The flaw is the absence of that reconciliation: a port partner can emit a frame whose CRC validates but whose header claims more objects than the body delivers, and the driver then consumes stale stack contents as if they were received payload. The result is a bounded information leak from uninitialized kernel stack memory to the attached device rather than memory corruption or code execution, hence the confidentiality impact in the physical-vector reassessment. No CWE was supplied with the record, and the sources do not describe any additional trigger path beyond the malformed PD frame on the Maxim TCPC receive path; exploitation depends on the tcpci_maxim driver being loaded and bound to Maxim Type-C controller hardware.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Trigger requires a physically attached malicious USB-C partner (AV:P, PR:N, UI:N); uninitialized stack read gives low information disclosure (C:L) and possible instability (A:L), not a clean A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this, and rightfully reject the message, instead of reading from uninitialized stack memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB