In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() In… (CVE-2026-64330)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix is available that validates the SVID index before accessing the array in svdm_consume_modes(). Users should apply the official Linux kernel updates that include this patch. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() In svdm_consume_modes(), the SVID value is read from pmdata->svids using pmdata->svid_index as an array index without bounds validation: paltmode->svid = pmdata->svids[pmdata->svid_index]; If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data is embedded inside struct tcpm_port, indexing past svids reads into adjacent fields. In particular: - At index 16, it reads the altmodes count. - At index 18 and beyond, it reads into altmode_desc[], which contains partner-supplied SVDM Discovery Modes VDOs. By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index to 20, the partner can force paltmode->svid to be loaded with an arbitrary, partner- chosen SVID, which is then registered via typec_partner_register_altmode(). Fix this by validating that pmdata->svid_index is non-negative and strictly less than pmdata->nsvids before accessing the pmdata->svids array inside svdm_consume_modes().
Impact
The vulnerability allows a connected USB Type-C partner device to cause the kernel to read out-of-bounds memory and register an arbitrary SVID. This could potentially lead to incorrect behavior in USB Type-C alternate mode handling or other kernel subsystems relying on SVID values. No direct evidence of code execution or privilege escalation is provided. No known exploits in the wild have been reported.
Summary
The Linux kernel vulnerability CVE-2026-64330 involves an out-of-bounds read in the usb: typec: tcpm driver within the svdm_consume_modes() function. The function reads the SVID value from an array using an index (pmdata->svid_index) without validating that the index is within bounds. If the index exceeds the maximum allowed (SVID_DISCOVERY_MAX = 16), it reads beyond the array into adjacent memory fields, including altmode descriptors controlled by a connected partner device. By manipulating the index and altmode descriptors, a partner device can cause the kernel to register an arbitrary SVID via typec_partner_register_altmode(). The vulnerability was fixed by adding validation to ensure pmdata->svid_index is non-negative and less than the number of SVIDs (pmdata->nsvids) before array access.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64330 (opens in a new tab)
- git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407 (opens in a new tab)
- git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b (opens in a new tab)
- git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4 (opens in a new tab)
- git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491 (opens in a new tab)
- git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53 (opens in a new tab)
- git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f (opens in a new tab)
- git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c (opens in a new tab)
- git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad (opens in a new tab)