CVE-2026-63963 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdm_consume_identity() or svdm_consume_identity_sop_prime() as the device-controlled value could index off of the static arrays, which could leak data.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/569f7971542eb10025d8a0989b83f28a29d8ba20
https://git.kernel.org/stable/c/8fbc349e8383125dd2d8de1c1e926279d398ab17
https://git.kernel.org/stable/c/ed8649f3822e211d025bcab5158af6f8a38c8705
https://git.kernel.org/stable/c/f9d787fbe83127105e42088cca40e5118db0d810

History

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdm_consume_identity() or svdm_consume_identity_sop_prime() as the device-controlled value could index off of the static arrays, which could leak data.
Title		usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/569f7971542eb10025d8a0989b83f28a29d8ba20 https://git.kernel.org/stable/c/8fbc349e8383125dd2d8de1c1e926279d398ab17 https://git.kernel.org/stable/c/ed8649f3822e211d025bcab5158af6f8a38c8705 https://git.kernel.org/stable/c/f9d787fbe83127105e42088cca40e5118db0d810

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:52.388Z

Updated: 2026-07-20T06:41:43.925Z

Reserved: 2026-07-19T07:54:57.024Z

Link: CVE-2026-63963

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63963", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.024Z", "datePublished": "2026-07-19T14:55:52.388Z", "dateUpdated": "2026-07-20T06:41:43.925Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T06:41:43.925Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: validate VDO count in Discover Identity ACK handlers\n\nProperly validate the count passed from a device when calling\nsvdm_consume_identity() or svdm_consume_identity_sop_prime() as the\ndevice-controlled value could index off of the static arrays, which\ncould leak data."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/tcpm/tcpm.c"], "versions": [{"version": "f0690a25a140b853b1842fa80faf828601bb47e8", "lessThan": "569f7971542eb10025d8a0989b83f28a29d8ba20", "status": "affected", "versionType": "git"}, {"version": "f0690a25a140b853b1842fa80faf828601bb47e8", "lessThan": "f9d787fbe83127105e42088cca40e5118db0d810", "status": "affected", "versionType": "git"}, {"version": "f0690a25a140b853b1842fa80faf828601bb47e8", "lessThan": "ed8649f3822e211d025bcab5158af6f8a38c8705", "status": "affected", "versionType": "git"}, {"version": "f0690a25a140b853b1842fa80faf828601bb47e8", "lessThan": "8fbc349e8383125dd2d8de1c1e926279d398ab17", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/tcpm/tcpm.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/569f7971542eb10025d8a0989b83f28a29d8ba20"}, {"url": "https://git.kernel.org/stable/c/f9d787fbe83127105e42088cca40e5118db0d810"}, {"url": "https://git.kernel.org/stable/c/ed8649f3822e211d025bcab5158af6f8a38c8705"}, {"url": "https://git.kernel.org/stable/c/8fbc349e8383125dd2d8de1c1e926279d398ab17"}], "title": "usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers", "x_generator": {"engine": "bippy-1.2.0"}}}}