Skip to main content

Linux Kernel CVE-2026-64330

| EUVDEUVD-2026-48874 HIGH
Improper Validation of Array Index (CWE-129)
2026-07-25 Linux GHSA-5x5w-f8x6-m8wf
Buffer Overflow Linux Red Hat Suse
High
Disputed · 7.8 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.8 MEDIUM

Physical USB-C device plug-in required (AV:P overrides official AV:L); malicious partner device needs no system authentication so PR:N.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
3.5 LOW
AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 14:55 vuln.today
CVSS changed
Sep 04, 2026 - 14:52 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:49 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

In svdm_consume_modes(), the SVID value is read from pmdata->svids using pmdata->svid_index as an array index without bounds validation:

paltmode->svid = pmdata->svids[pmdata->svid_index];

If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data is embedded inside struct tcpm_port, indexing past svids reads into adjacent fields. In particular:

  • At index 16, it reads the altmodes count.
  • At index 18 and beyond, it reads into altmode_desc[], which contains

partner-supplied SVDM Discovery Modes VDOs.

By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index to 20, the partner can force paltmode->svid to be loaded with an arbitrary, partner- chosen SVID, which is then registered via typec_partner_register_altmode().

Fix this by validating that pmdata->svid_index is non-negative and strictly less than pmdata->nsvids before accessing the pmdata->svids array inside svdm_consume_modes().

AnalysisAI

Out-of-bounds array read in the Linux kernel's USB Type-C Port Manager (TCPM) svdm_consume_modes() function allows a physically connected malicious USB-C partner device to read kernel memory beyond the svids[] array boundary and force registration of an arbitrary, attacker-chosen SVID via typec_partner_register_altmode(). The vulnerability arises because pmdata->svid_index - which is incremented in response to partner-supplied SVDM messages - is never validated against SVID_DISCOVERY_MAX (16) before indexing pmdata->svids[]. Patches are confirmed available across eight stable kernel branches (5.10 through 7.2-rc3); no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

The vulnerable code resides in the Linux kernel's TCPM subsystem (drivers/usb/typec/tcpm/tcpm.c), which orchestrates USB Power Delivery SVDM (Structured Vendor Defined Message) Discover Modes negotiation with USB-C partner devices. CWE-129 (Improper Validation of Array Index) applies: the struct pd_mode_data is embedded inside struct tcpm_port, and its svids[] field is statically sized to SVID_DISCOVERY_MAX (16 entries). Because svid_index is driven upward by partner-controlled SVDM responses without a bounds check, reading svids[svid_index] for indices ≥16 crosses struct boundaries: index 16 reads the altmodes count field, index 18+ reads into altmode_desc[] entries that hold partner-supplied SVDM Discovery Modes VDOs. The attacker can thus pre-load a chosen SVID value into altmode_desc[0].vdo via earlier SVDM messages, drive svid_index to 20, and have the kernel register that attacker-controlled value as a legitimate altmode. The fix introduces a bounds check ensuring svid_index is non-negative and strictly less than pmdata->nsvids. Affected CPE: cpe:2.3:a:linux:linux:* from commit 4ab8c18d4d67321cc7b660559de17511d4fc0237 onward until the respective fix commits per stable branch.

RemediationAI

Upgrade the running Linux kernel to a patched stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc3 or later. Fix commits are available at git.kernel.org/stable/c/ for each branch (see references). Distribution-specific backports will be published through Ubuntu USN, Debian DSA, Red Hat RHSA, and SUSE SLES security channels - monitor those for kernels not directly tracking upstream stable. As an immediate compensating control where patching is not feasible, restrict physical access to USB-C ports using port blockers or BIOS/UEFI USB disable settings; note this entirely disables USB-C functionality and is disruptive. Alternatively, udev rules can be deployed to prevent automatic TCPM enumeration on untrusted devices, though this requires careful policy configuration and may break legitimate USB-C peripherals.

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-56770 HIGH POC
8.7
CVE-2017-7228 HIGH POC
8.2

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.150 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.193 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.169 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.223 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.167 Affected
Image SLES-GCE-3P Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected

Share

CVE-2026-64330 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy