EUVD-2026-45736
GHSA-p527-vfp9-6cmq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttach malicious USB-C PD partner device
-
DeliverySend Discover Identity ACK with bogus VDO count
-
ExploitTrigger unvalidated index past static VDO arrays
-
ExecutionRead out-of-bounds kernel memory
-
ImpactLeak adjacent data or crash
Vulnerability Assessment
| Exploitation Conditions | Requires a malicious or compromised USB Type-C Power Delivery partner device physically attached to a host whose kernel includes the TCPM driver (CONFIG_TYPEC_TCPM) and negotiates Structured VDM Discover Identity; the hostile device must return a Discover Identity ACK on SOP or SOP' with an attacker-controlled VDO count that the ACK handlers fail to bound-check. Limiting factors: exploitation is gated on physically connecting a hostile USB-C device, affects only unpatched kernels prior to 6.12.93/6.18.35/7.0.12/7.1, and is local in scope with no network reachability; it does not apply to systems without Type-C PD hardware or the TCPM driver active. |
| Impact | Signals point to a real but low-urgency medium issue. The NVD CVSS is 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning local, low-complexity, low-privilege, no user interaction, with the recorded impact being availability only. EPSS is 0.20% (10th percentile), indicating very low predicted exploitation, and there is no CISA KEV listing and no public exploit identified at time of analysis, so the vuln.today 'this_month' decision label reflects routine patch cadence rather than an emergency. Two signals conflict and should be verified: (1) the Description and the 'Information Disclosure' tag say the flaw 'could leak data,' which implies a confidentiality impact, yet the NVD vector records C:N and A:H - treat the impact classification as unsettled; (2) the mechanism is a device-controlled VDO count from a USB Type-C Power Delivery partner, which in practice requires attaching a hostile device, so the AV:L/PR:L framing understates the physical-attachment requirement. Net: a legitimate out-of-bounds-read hardening fix worth applying this cycle, not a widespread-exploitation priority. |
| Exploit ScenarioDerived | An attacker attaches a malicious or compromised USB-C Power Delivery device to a host running the TCPM driver and, during Structured VDM Discover Identity negotiation, returns a Discover Identity ACK (SOP or SOP') carrying an attacker-chosen VDO count that the handler does not validate. svdm_consume_identity()/svdm_consume_identity_sop_prime() then index past static arrays, reading out-of-bounds kernel memory and potentially leaking data or destabilizing the system. No public exploit identified at time of analysis; the local vector and physical device requirement keep complexity low but reach limited. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Linux kernel USB Type-C Power Delivery handling in the TCPM driver fails to bound-check the VDO count returned by an attached partner device, letting a hostile or compromised USB-C device drive an out-of-bounds index into static arrays and expose kernel memory contents. Only systems whose kernels enable the TCPM driver (CONFIG_TYPEC_TCPM) and that negotiate Structured VDM Discover Identity are exposed, and the assessed vector requires physical attachment of the malicious device (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), yielding limited confidentiality and availability impact rather than code execution. Unpatched kernels before 6.12.93, 6.18.35, 7.0.12 and 7.1 are affected; EPSS is 0.20% (10th percentile), no CISA KEV entry or public exploit code is present in the available data, and the priority decision label is 'this_month'.
RemediationAI
Apply the vendor kernel updates that carry the fix: 6.12.93 for the 6.12.y branch, 6.18.35 for the 6.18.y branch, and 7.0.12 or 7.1 for the corresponding newer lines - shipped as the stable commits 569f7971542eb10025d8a0989b83f28a29d8ba20, f9d787fbe83127105e42088cca40e5118db0d810, ed8649f3822e211d025bcab5158af6f8a38c8705, 8fbc349e8383125dd2d8de1c1e926279d398ab17, 6bacd22e1eae77abf089bbdc016270200a8dc83b and 150c30131c032b4b1ad9acd29f2834321d85ae4b, with distribution kernels covered by Ubuntu advisory USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1) and vendor advisories referenced at https://vuldb.com/vuln/380418 and https://seclists.org/oss-sec/2026/q3/230. Where immediate patching is not possible, exposure is bounded by the physical prerequisite: only a hostile or compromised USB-C PD partner plugged into the port can supply the malformed Discover Identity ACK, so restricting physical port access to trusted devices and to trusted users prevents the trigger at the cost of limiting legitimate USB-C peripherals. Systems with no Type-C PD hardware or without CONFIG_TYPEC_TCPM compiled/loaded do not run the affected handlers; disabling or not loading the tcpm driver removes the attack path but also disables USB-C Power Delivery negotiation, role swap and alternate-mode handling on those ports, so treat it as a temporary measure rather than a deployment posture.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a flaw in the kernel's USB Type-C Power Delivery state machine, the tcpm driver, which speaks the PD protocol to port partners and cable plugs over the CC lines. During Structured VDM discovery the host issues Discover Identity and parses the Identity ACK returned by the partner; the vulnerable handlers svdm_consume_identity() (SOP, partner) and svdm_consume_identity_sop_prime() (SOP', cable) consume the device-supplied VDO count and iterate the returned VDOs against static arrays without validating that the count stays in range. Because the count is controlled by the attached device, an out-of-range value can index past the end of those static arrays and read adjacent kernel memory, which the affected code path can surface as leaked data. The root-cause class maps to improper input validation leading to an out-of-bounds read (no CWE identifier was supplied in the source data), and exposure is gated on Type-C PD hardware plus an active TCPM driver performing Structured VDM discovery. The commit history shows the fix applied across multiple stable branches, with the vulnerable code originating in the initial kernel import commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Triggering needs a physically attached hostile USB-C PD device, so AV:P and PR:N; the unvalidated static-array index is an out-of-bounds read leaking limited kernel memory (C:L) with possible instability (A:L).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
Properly validate the count passed from a device when calling svdm_consume_identity() or svdm_consume_identity_sop_prime() as the device-controlled value could index off of the static arrays, which could leak data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB