The Linux kernel's USB Type-C UCSI driver had a vulnerability where the ucsi_connector_change() function used a connector number from a UCSI CCI notification to index the ucsi->connector[] array without verifying that the connector number was within valid bounds. Since the connector number is a 7-bit field supplied by the PPM, a malicious or faulty PPM (such as EC firmware or an I2C-attached UCSI controller) could supply an invalid connector number, leading to out-of-bounds memory access via schedule_work() on memory beyond the array. The vulnerability was addressed by adding validation to reject connector numbers that are zero or exceed the number of connectors reported at initialization.

This vulnerability could allow a malicious or buggy Platform Policy Manager to trigger out-of-bounds memory access in kernel space, potentially leading to memory corruption or system instability. However, no known exploits in the wild have been reported. The impact is limited to systems using the affected USB Type-C UCSI driver with vulnerable kernel versions.

A fix has been implemented in the Linux kernel to validate connector numbers before accessing the ucsi->connector[] array, preventing out-of-bounds access. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the specific fixed kernel versions and apply updates accordingly.