In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT A… (CVE-2026-63959)
A vulnerability in the Linux kernel's USB Type-C driver (tcpm/tcpci_maxim) was addressed by validating the header NDO field against the RX_BYTE_CNT. The issue allowed a broken or malicious port to send a CRC-valid frame that claimed up to seven data objects in its header but contained fewer in the body, leading to reading uninitialized stack memory. This validation prevents improper memory reads from malformed USB Type-C messages.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-63959 involves the USB Type-C driver (tcpm/tcpci_maxim) improperly handling frames where the header indicates more data objects than are actually present in the frame body. A malicious or broken USB Type-C port could send a CRC-valid frame with a header advertising up to seven data objects but fewer in the payload, causing the kernel to read uninitialized stack memory. The fix involves validating the header's NDO field against the actual RX_BYTE_CNT and rejecting such malformed messages to prevent this unsafe memory access.
Potential Impact
The vulnerability could lead to the Linux kernel reading uninitialized stack memory when processing malformed USB Type-C frames. This may cause information leakage or undefined behavior in the kernel. There is no indication of known exploits in the wild. The impact is limited to systems using the affected USB Type-C driver code.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to validate the header NDO against RX_BYTE_CNT and reject malformed frames. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory for the exact fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT A… (CVE-2026-63959)
Description
A vulnerability in the Linux kernel's USB Type-C driver (tcpm/tcpci_maxim) was addressed by validating the header NDO field against the RX_BYTE_CNT. The issue allowed a broken or malicious port to send a CRC-valid frame that claimed up to seven data objects in its header but contained fewer in the body, leading to reading uninitialized stack memory. This validation prevents improper memory reads from malformed USB Type-C messages.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-63959 involves the USB Type-C driver (tcpm/tcpci_maxim) improperly handling frames where the header indicates more data objects than are actually present in the frame body. A malicious or broken USB Type-C port could send a CRC-valid frame with a header advertising up to seven data objects but fewer in the payload, causing the kernel to read uninitialized stack memory. The fix involves validating the header's NDO field against the actual RX_BYTE_CNT and rejecting such malformed messages to prevent this unsafe memory access.
Potential Impact
The vulnerability could lead to the Linux kernel reading uninitialized stack memory when processing malformed USB Type-C frames. This may cause information leakage or undefined behavior in the kernel. There is no indication of known exploits in the wild. The impact is limited to systems using the affected USB Type-C driver code.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to validate the header NDO against RX_BYTE_CNT and reject malformed frames. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fwcg-qvj5-vv4j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63959"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912e8c2
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 20:05:07 UTC
Last updated: 07/20/2026, 17:50:56 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.