---
id: CVE-2026-63962
title: 'usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

  svdm_consume_modes() checks pmdata->altmodes against the array size once
  before the loop o…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 <
    816c6251409db28f1b875988fcbd2ff1764a81f0
  - >-
    Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 <
    845598b154b9a92e9d279fafafa9405c121ae805
  - >-
    Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 <
    4505f33dab56c274e82f47f94bf60a8cbf8f4b42
  - >-
    Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 <
    cbad85b446c06adbc5e5bed565871bb918ce9d32
  - >-
    Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 <
    3389c149c68c3fea61910ad5d34f7bf3bff44e32
  - Linux 4.19
published: '2026-07-19'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:42:45.904Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63962'
references:
  - url: 'https://git.kernel.org/stable/c/816c6251409db28f1b875988fcbd2ff1764a81f0'
  - url: 'https://git.kernel.org/stable/c/845598b154b9a92e9d279fafafa9405c121ae805'
  - url: 'https://git.kernel.org/stable/c/4505f33dab56c274e82f47f94bf60a8cbf8f4b42'
  - url: 'https://git.kernel.org/stable/c/cbad85b446c06adbc5e5bed565871bb918ce9d32'
  - url: 'https://git.kernel.org/stable/c/3389c149c68c3fea61910ad5d34f7bf3bff44e32'
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.0997
ingestedAt: '2026-10-21T12:48:53.612Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

svdm_consume_modes() checks pmdata->altmodes against the array size once
before the loop over the count, but forgot to check the bound at every
point in the loop.

In the well-behaved SVDM discovery flow this is harmless because each of
at most SVID_DISCOVERY_MAX SVIDs contributes at most MODE_DISCOVERY_MAX
modes, exactly filling altmode_desc[ALTMODE_DISCOVERY_MAX].  But the
CMDT_RSP_ACK handler in tcpm_pd_svdm() does not correlate an incoming
ACK with any request the port actually sent.  Once port->partner is set,
an unsolicited Discover Modes ACK is consumed unconditionally.  A broken
or malicious port partner can therefore drive altmodes to
ALTMODE_DISCOVERY_MAX - 1 via the normal flow, and then send one extra
Discover Modes ACK with seven VDOs.  Because the pre-loop check passes,
the loop could then writes up to five entries past altmode_desc[].  For
mode_data_prime the next field in struct tcpm_port is the
partner_altmode[] pointer array, which then receives partner-chosen
SVID/VDO bytes.

Move the bound check inside the loop so the array can never be indexed
past ALTMODE_DISCOVERY_MAX regardless of how many VDOs the partner
supplies or how the function was reached.

## Affected

- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 816c6251409db28f1b875988fcbd2ff1764a81f0`
- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 845598b154b9a92e9d279fafafa9405c121ae805`
- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 4505f33dab56c274e82f47f94bf60a8cbf8f4b42`
- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < cbad85b446c06adbc5e5bed565871bb918ce9d32`
- `Linux >= 4ab8c18d4d67321cc7b660559de17511d4fc0237 < 3389c149c68c3fea61910ad5d34f7bf3bff44e32`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.