Linux Kernel CVE-2026-63962

Exploitation requires the host to run the Linux kernel USB Type-C Port Manager (tcpm) with Power Delivery Structured VDM alternate-mode discovery, and the attacker must present a malicious or broken USB-C port partner that is physically connected. The specific trigger stated in the source: once port->partner is set, the CMDT_RSP_ACK handler in tcpm_pd_svdm() consumes an unsolicited Discover Modes ACK unconditionally without correlating it to a sent request, so the partner first drives altmodes to ALTMODE_DISCOVERY_MAX-1 through the normal flow and then sends one extra Discover Modes ACK containing seven VDOs, which passes the single pre-loop bound check and writes past altmode_desc[]. Limiting factors that reduce real-world risk: a physical/adjacent malicious USB-C device is required (no network path), only kernels containing the vulnerable svdm_consume_modes() loop are affected, and exploitation depends on the attacker controlling the port-partner device rather than on any host-side user action.

This is a bounded out-of-bounds write in the Linux kernel USB Type-C Port Manager (tcpm) driver. The supplied CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) models only an availability impact, but the description is explicit that a broken or malicious USB-C port partner can drive altmodes to ALTMODE_DISCOVERY_MAX-1 and then send one extra Discover Modes ACK with seven VDOs, writing up to five entries past altmode_desc[] into the adjacent partner_altmode[] pointer array with partner-chosen SVID/VDO bytes - that is attacker-influenced memory corruption, which implies an integrity impact the input vector scores as I:N. There is also tension in the attack vector: the attacker here is a connected USB-C device partner, which is physical/adjacent rather than a logged-in local user, so AV:L/PR:L understates the need for a malicious device and overstates it as ordinary authenticated-local access - verify the intended attack model with the vendor. On exploitation signals the picture is low urgency: EPSS is 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the only elevated signal is the vendor priority label 'this_month' and the broad affected footprint. Net assessment: a real but non-emergency hardening fix - genuine kernel memory corruption reachable only by an attacker who can present a malicious USB-C partner device, so realistic risk is far lower than the ubiquity of Linux would suggest.

An attacker connects a malicious or deliberately non-compliant USB-C Power Delivery device (or uses compromised partner firmware) to a target running a vulnerable kernel. After the normal SVDM discovery flow fills altmode_desc[] to ALTMODE_DISCOVERY_MAX-1, the device sends an unsolicited Discover Modes ACK carrying seven VDOs; because the bound is checked only once before the loop, the kernel writes partner-controlled bytes past the array into the adjacent partner_altmode[] pointer storage, corrupting kernel memory. No public exploit identified at time of analysis.