{"id":"CVE-2026-63962","title":"usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()\n\nsvdm_consume_modes() checks pmdata->altmodes against the array size once\nbefore the loop o…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 816c6251409db28f1b875988fcbd2ff1764a81f0","Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 845598b154b9a92e9d279fafafa9405c121ae805","Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 4505f33dab56c274e82f47f94bf60a8cbf8f4b42","Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < cbad85b446c06adbc5e5bed565871bb918ce9d32","Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 3389c149c68c3fea61910ad5d34f7bf3bff44e32","Linux 4.19"],"published":"2026-07-19","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:42:45.904Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63962","references":[{"url":"https://git.kernel.org/stable/c/816c6251409db28f1b875988fcbd2ff1764a81f0"},{"url":"https://git.kernel.org/stable/c/845598b154b9a92e9d279fafafa9405c121ae805"},{"url":"https://git.kernel.org/stable/c/4505f33dab56c274e82f47f94bf60a8cbf8f4b42"},{"url":"https://git.kernel.org/stable/c/cbad85b446c06adbc5e5bed565871bb918ce9d32"},{"url":"https://git.kernel.org/stable/c/3389c149c68c3fea61910ad5d34f7bf3bff44e32"}],"tags":["cve.org"],"epss":0.00206,"epssPercentile":0.0997,"ingestedAt":"2026-10-21T12:48:53.612Z","slug":"CVE-2026-63962","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()\n\nsvdm_consume_modes() checks pmdata->altmodes against the array size once\nbefore the loop over the count, but forgot to check the bound at every\npoint in the loop.\n\nIn the well-behaved SVDM discovery flow this is harmless because each of\nat most SVID_DISCOVERY_MAX SVIDs contributes at most MODE_DISCOVERY_MAX\nmodes, exactly filling altmode_desc[ALTMODE_DISCOVERY_MAX].  But the\nCMDT_RSP_ACK handler in tcpm_pd_svdm() does not correlate an incoming\nACK with any request the port actually sent.  Once port->partner is set,\nan unsolicited Discover Modes ACK is consumed unconditionally.  A broken\nor malicious port partner can therefore drive altmodes to\nALTMODE_DISCOVERY_MAX - 1 via the normal flow, and then send one extra\nDiscover Modes ACK with seven VDOs.  Because the pre-loop check passes,\nthe loop could then writes up to five entries past altmode_desc[].  For\nmode_data_prime the next field in struct tcpm_port is the\npartner_altmode[] pointer array, which then receives partner-chosen\nSVID/VDO bytes.\n\nMove the bound check inside the loop so the array can never be indexed\npast ALTMODE_DISCOVERY_MAX regardless of how many VDOs the partner\nsupplies or how the function was reached.\n\n## Affected\n\n- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 816c6251409db28f1b875988fcbd2ff1764a81f0`\n- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 845598b154b9a92e9d279fafafa9405c121ae805`\n- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 4505f33dab56c274e82f47f94bf60a8cbf8f4b42`\n- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < cbad85b446c06adbc5e5bed565871bb918ce9d32`\n- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 3389c149c68c3fea61910ad5d34f7bf3bff44e32`\n- `Linux 4.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}