{"id":"CVE-2026-63963","title":"usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: validate VDO count in Discover Identity ACK handlers\n\nProperly validate the count passed from a device when calling\nsvdm_consume_identity() or svdm_co…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < 6bacd22e1eae77abf089bbdc016270200a8dc83b","Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < 569f7971542eb10025d8a0989b83f28a29d8ba20","Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < f9d787fbe83127105e42088cca40e5118db0d810","Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < ed8649f3822e211d025bcab5158af6f8a38c8705","Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < 8fbc349e8383125dd2d8de1c1e926279d398ab17","Linux 4.12"],"published":"2026-07-19","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:42:46.982Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63963","references":[{"url":"https://git.kernel.org/stable/c/6bacd22e1eae77abf089bbdc016270200a8dc83b"},{"url":"https://git.kernel.org/stable/c/569f7971542eb10025d8a0989b83f28a29d8ba20"},{"url":"https://git.kernel.org/stable/c/f9d787fbe83127105e42088cca40e5118db0d810"},{"url":"https://git.kernel.org/stable/c/ed8649f3822e211d025bcab5158af6f8a38c8705"},{"url":"https://git.kernel.org/stable/c/8fbc349e8383125dd2d8de1c1e926279d398ab17"}],"tags":["cve.org"],"epss":0.00206,"epssPercentile":0.0997,"ingestedAt":"2026-10-21T12:48:53.613Z","slug":"CVE-2026-63963","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: validate VDO count in Discover Identity ACK handlers\n\nProperly validate the count passed from a device when calling\nsvdm_consume_identity() or svdm_consume_identity_sop_prime() as the\ndevice-controlled value could index off of the static arrays, which\ncould leak data.\n\n## Affected\n\n- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < 6bacd22e1eae77abf089bbdc016270200a8dc83b`\n- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < 569f7971542eb10025d8a0989b83f28a29d8ba20`\n- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < f9d787fbe83127105e42088cca40e5118db0d810`\n- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < ed8649f3822e211d025bcab5158af6f8a38c8705`\n- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < 8fbc349e8383125dd2d8de1c1e926279d398ab17`\n- `Linux 4.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}