The Linux kernel vulnerability CVE-2026-63962 concerns the usb: typec: tcpm driver, specifically in the svdm_consume_modes() function. The function initially checked the size of the altmode_desc[] array only once before looping over mode descriptors, but did not check bounds on each iteration. A malicious USB Type-C partner can exploit this by sending an unsolicited Discover Modes ACK with more VDOs than expected, causing writes up to five entries past the array boundary. This results in out-of-bounds memory writes to adjacent fields in the tcpm_port structure, potentially leading to memory corruption. The fix involved moving the bounds check inside the loop to ensure no out-of-bounds indexing occurs regardless of input.

The vulnerability allows a malicious or broken USB Type-C partner device to cause out-of-bounds writes in kernel memory, potentially leading to memory corruption. This could affect system stability or security depending on how the corrupted memory is used. No known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel USB Type-C TCPM driver and interacting with malicious USB Type-C partners.

A fix for this vulnerability has been implemented in the Linux kernel by moving the bounds check inside the loop in svdm_consume_modes(). Users and administrators should apply the official Linux kernel updates that include this fix once available. Patch status is not yet confirmed from the vendor advisory; check the Linux kernel security advisories for current remediation guidance.