The Linux kernel vulnerability CVE-2026-64330 involves an out-of-bounds read in the usb: typec: tcpm driver within the svdm_consume_modes() function. The function reads the SVID value from an array using an index (pmdata->svid_index) without validating that the index is within bounds. If the index exceeds the maximum allowed (SVID_DISCOVERY_MAX = 16), it reads beyond the array into adjacent memory fields, including altmode descriptors controlled by a connected partner device. By manipulating the index and altmode descriptors, a partner device can cause the kernel to register an arbitrary SVID via typec_partner_register_altmode(). The vulnerability was fixed by adding validation to ensure pmdata->svid_index is non-negative and less than the number of SVIDs (pmdata->nsvids) before array access.

The vulnerability allows a connected USB Type-C partner device to cause the kernel to read out-of-bounds memory and register an arbitrary SVID. This could potentially lead to incorrect behavior in USB Type-C alternate mode handling or other kernel subsystems relying on SVID values. No direct evidence of code execution or privilege escalation is provided. No known exploits in the wild have been reported.

A fix is available that validates the SVID index before accessing the array in svdm_consume_modes(). Users should apply the official Linux kernel updates that include this patch. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.