The Linux kernel's usb: typec: wcove driver contained a vulnerability in wcove_read_rx_buffer() where the function copied data from the PD RX FIFO into a struct pd_message without adequate bounds checking. The RXINFO field indicating the byte count is a 5-bit field with a maximum of 31 bytes, while struct pd_message is only 30 bytes. A malicious USB Type-C partner could send a 31-byte frame, causing the loop to write one byte past the struct pd_message buffer if hardware limits are not enforced. Furthermore, regmap_read() writes a full unsigned int (4 bytes) per call, but the code passed a byte pointer, causing up to three zero bytes to be written past the buffer on the last iteration. This leads to potential stack corruption in the IRQ thread. The vulnerability was fixed by clamping the loop to the size of struct pd_message and reading registers into a local variable before storing only the low byte, ensuring no overflow occurs regardless of RXINFO values.

This vulnerability could allow a malicious USB Type-C device to cause out-of-bounds writes in kernel memory, specifically overwriting stack memory in the IRQ thread. Such memory corruption could lead to kernel instability, crashes, or potentially privilege escalation if exploited. However, no known exploits are reported in the wild at this time.

A fix has been implemented in the Linux kernel to clamp the copy loop to the size of struct pd_message and to safely handle register reads to prevent out-of-bounds writes. Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed from vendor advisories; check the Linux kernel mailing lists or official repositories for the updated kernel versions containing this fix.