---
id: CVE-2026-63963
title: 'usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers

  Properly validate the count passed from a device when calling
  svdm_consume_identity() or svdm_co…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 <
    6bacd22e1eae77abf089bbdc016270200a8dc83b
  - >-
    Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 <
    569f7971542eb10025d8a0989b83f28a29d8ba20
  - >-
    Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 <
    f9d787fbe83127105e42088cca40e5118db0d810
  - >-
    Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 <
    ed8649f3822e211d025bcab5158af6f8a38c8705
  - >-
    Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 <
    8fbc349e8383125dd2d8de1c1e926279d398ab17
  - Linux 4.12
published: '2026-07-19'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:42:46.982Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63963'
references:
  - url: 'https://git.kernel.org/stable/c/6bacd22e1eae77abf089bbdc016270200a8dc83b'
  - url: 'https://git.kernel.org/stable/c/569f7971542eb10025d8a0989b83f28a29d8ba20'
  - url: 'https://git.kernel.org/stable/c/f9d787fbe83127105e42088cca40e5118db0d810'
  - url: 'https://git.kernel.org/stable/c/ed8649f3822e211d025bcab5158af6f8a38c8705'
  - url: 'https://git.kernel.org/stable/c/8fbc349e8383125dd2d8de1c1e926279d398ab17'
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.0997
ingestedAt: '2026-10-21T12:48:53.613Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers

Properly validate the count passed from a device when calling
svdm_consume_identity() or svdm_consume_identity_sop_prime() as the
device-controlled value could index off of the static arrays, which
could leak data.

## Affected

- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < 6bacd22e1eae77abf089bbdc016270200a8dc83b`
- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < 569f7971542eb10025d8a0989b83f28a29d8ba20`
- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < f9d787fbe83127105e42088cca40e5118db0d810`
- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < ed8649f3822e211d025bcab5158af6f8a38c8705`
- `Linux >= f0690a25a140b853b1842fa80faf828601bb47e8 < 8fbc349e8383125dd2d8de1c1e926279d398ab17`
- `Linux 4.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.