CVE-2026-63963

Published: Jul 19, 2026Modified: Oct 30, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdm_consume_identity() or svdm_consume_identity_sop_prime() as the device-controlled value could index off of the static arrays, which could leak data.

Affected (10)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	4.12 ≤ version < 6.1.191
Linux Linux Kernel	6.13 ≤ version < 6.18.35
Linux Linux Kernel	6.19 ≤ version < 7.0.12
Linux Linux Kernel	6.2 ≤ version < 6.6.160
Linux Linux Kernel	6.7 ≤ version < 6.12.93
Linux Linux Kernel	Version 7.1 rc1
Linux Linux Kernel	Version 7.1 rc2
Linux Linux Kernel	Version 7.1 rc3
Linux Linux Kernel	Version 7.1 rc4
Linux Linux Kernel	Version 7.1 rc5