VulnerabilityPublished 1 May 2026Updated 6 Nov 2026

CVE-2026-31729: Linux kernel · usb: typec: ucsi: validate connector number in ucsi_notify_common()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f6dcbf2b024d55549959402f1db6c614e51d52cb : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:04 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in f6dcbf2b024d55549959402f1db6c614e51d52cb, f4e608fe12b7ac6a4a57176ab0296bb5a110a078, d2d8c17ac01a1b1f638ea5d340a884ccc5015186 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 1 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to f6dcbf2b024d55549959402f1db6c614e51d52cb, f4e608fe12b7ac6a4a57176ab0296bb5a110a078, d2d8c17ac01a1b1f638ea5d340a884ccc5015186 or 98429e9ec89a5e3a204112dfaa2dbe6ca28493a0.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ bdc62f2bae8fb0e8e99574de5232f0a3c54a27df, < f6dcbf2b024d55549959402f1db6c614e51d52cb	Fixed in f6dcbf2b024d55549959402f1db6c614e51d52cb
LinuxLinux	Affected ≥ bdc62f2bae8fb0e8e99574de5232f0a3c54a27df, < f4e608fe12b7ac6a4a57176ab0296bb5a110a078	Fixed in f4e608fe12b7ac6a4a57176ab0296bb5a110a078
LinuxLinux	Affected ≥ bdc62f2bae8fb0e8e99574de5232f0a3c54a27df, < d2d8c17ac01a1b1f638ea5d340a884ccc5015186	Fixed in d2d8c17ac01a1b1f638ea5d340a884ccc5015186
LinuxLinux	Affected ≥ bdc62f2bae8fb0e8e99574de5232f0a3c54a27df, < 98429e9ec89a5e3a204112dfaa2dbe6ca28493a0	Fixed in 98429e9ec89a5e3a204112dfaa2dbe6ca28493a0
LinuxLinux	Affected =5.5	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_notify_common() The connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a 7-bit field (0-127) that is used to index into the connector array in ucsi_connector_change(). However, the array is only allocated for the number of connectors reported by the device (typically 2-4 entries). A malicious or malfunctioning device could report an out-of-range connector number in the CCI, causing an out-of-bounds array access in ucsi_connector_change(). Add a bounds check in ucsi_notify_common(), the central point where CCI is parsed after arriving from hardware, so that bogus connector numbers are rejected before they propagate further.

References

Community reviews

Loading reviews…