In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header… (CVE-2026-63964)
A vulnerability in the Linux kernel's USB Type-C UCSI CCG firmware update code allows a crafted firmware image without a ':' record header to cause a kernel crash. This occurs because the code does not properly handle the absence of ':' bytes in the firmware image, leading to a NULL pointer dereference and kernel oops. A root user with the ability to place files under /lib/firmware and write to the do_flash sysfs attribute can trigger this crash. The issue has been resolved by adding a check to bail out with an error when no ':' byte is found in the firmware image.
AI Analysis
Technical Summary
The Linux kernel's usb: typec: ucsi: ccg firmware update function do_flash() searches for ':' record headers in firmware images using strnchr(). If the firmware image lacks any ':' byte, strnchr() returns NULL, which is incorrectly compared to a valid pointer, causing the loop to execute with an invalid pointer and resulting in a kernel crash (oops). This can be triggered by a root user who can place a crafted firmware file under /lib/firmware and write to the do_flash sysfs attribute. The fix involves checking the initial strnchr() result and returning -EINVAL if no ':' is found, preventing the crash.
Potential Impact
A local root user can cause a denial of service by triggering a kernel crash (oops) via a crafted firmware image without ':' record headers. This leads to system instability or reboot but does not indicate code execution or privilege escalation beyond root access already required to exploit.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to check for the presence of ':' record headers in firmware images and bail out with an error if none are found, preventing the crash. Users should apply the official kernel updates that include this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or vendor advisories for the official patch and update guidance.
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header… (CVE-2026-63964)
Description
A vulnerability in the Linux kernel's USB Type-C UCSI CCG firmware update code allows a crafted firmware image without a ':' record header to cause a kernel crash. This occurs because the code does not properly handle the absence of ':' bytes in the firmware image, leading to a NULL pointer dereference and kernel oops. A root user with the ability to place files under /lib/firmware and write to the do_flash sysfs attribute can trigger this crash. The issue has been resolved by adding a check to bail out with an error when no ':' byte is found in the firmware image.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's usb: typec: ucsi: ccg firmware update function do_flash() searches for ':' record headers in firmware images using strnchr(). If the firmware image lacks any ':' byte, strnchr() returns NULL, which is incorrectly compared to a valid pointer, causing the loop to execute with an invalid pointer and resulting in a kernel crash (oops). This can be triggered by a root user who can place a crafted firmware file under /lib/firmware and write to the do_flash sysfs attribute. The fix involves checking the initial strnchr() result and returning -EINVAL if no ':' is found, preventing the crash.
Potential Impact
A local root user can cause a denial of service by triggering a kernel crash (oops) via a crafted firmware image without ':' record headers. This leads to system instability or reboot but does not indicate code execution or privilege escalation beyond root access already required to exploit.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to check for the presence of ':' record headers in firmware images and bail out with an error if none are found, preventing the crash. Users should apply the official kernel updates that include this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or vendor advisories for the official patch and update guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7w55-p3p4-26mv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63964"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912e21b
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 20:02:27 UTC
Last updated: 07/20/2026, 19:26:19 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.