Linux USB-C Vulnerability Allows Kernel Memory Overwrite by Rogue Accessories

On July 19, 2026, the Linux kernel project disclosed a memory corruption flaw in the USB Type-C Port Manager (TCPM) that lets a malicious or malfunctioning USB-C device overwrite kernel memory. Tracked as CVE-2026-63962, the vulnerability stems from a missing bounds check in the code that processes Alternate Mode discovery messages. A plugged-in accessory can send crafted data to exceed an internal array, potentially crashing the system or corrupting critical pointers. Patched kernels are already available, and Linux distributions are actively integrating the fix.

The bug resides in the svdm_consume_modes() function within the drivers/usb/typec/tcpm/tcpm.c source file. USB-C uses Structured Vendor Defined Messages (SVDM) to discover alternate modes—like DisplayPort or vendor-specific functions—supported by a connected device. The kernel stores discovered modes in a fixed-size array named altmode_desc[]. Prior to the patch, the code checked whether there was room in the array only once before entering a loop that processes incoming mode descriptors. If a device sent more descriptors than anticipated during that loop, the write would spill past the array boundary and corrupt adjacent memory.

Crucially, the state machine handling acknowledgements (CMDT_RSP_ACK) in tcpm_pd_svdm() does not correlate an incoming ACK with a request the port actually sent. Once a USB-C partner is established, an unsolicited Discover Modes ACK is consumed unconditionally. An attacker-controlled device can exploit this by first filling the legitimate discovery process up to one entry shy of the maximum, then sending an extra ACK with seven Video Data Objects (VDOs). The pre-loop checks passes, but the loop proceeds to write up to five entries beyond the array—overwriting the adjacent partner_altmode[] pointer array and allowing the partner to inject attacker-chosen bytes into kernel memory.

What’s at Stake: Beyond a Simple Crash

An out-of-bounds write in kernel memory is never trivial. In the worst case, this flaw could lead to local privilege escalation, denial of service, or arbitrary code execution with kernel rights. The immediate impact varies by hardware and kernel configuration; modern kernel hardening (KASLR, read-only memory, control-flow integrity) raise the bar for reliable exploitation, but pointer corruption in a security-critical subsystem remains a serious concern.

Even if a reliable root exploit isn’t publicly demonstrated, the bug can cause repeated system crashes when a malicious accessory is plugged in—a scenario that affects laptops, workstations, embedded systems, and any Linux device that relies on USB-C for docking, charging, or display output. For environments where physical access by untrusted individuals is possible (shared conference rooms, repair depots, public charging stations), the risk is tangible.

Who Needs to Patch Immediately

If you boot a Linux system with a USB-C port that uses the kernel’s TCPM implementation, you are potentially affected. The vulnerable code has been present since Linux 4.19, which powers countless long-support deployments, Android-based devices, IoT hardware, and custom enterprise kernels. According to the CVE record, the following stable branches are vulnerable prior to the listed fixed versions:

These are upstream reference points. Your distribution may backport the fix to older numbered releases (e.g., 5.15.x) without changing the visible kernel version. Always check your vendor’s security advisory rather than relying on version numbers alone.

Windows users are not directly exposed by this Linux kernel bug. However, mixed environments are common:
- Dual-boot workstations that run Linux for development or testing.
- Windows Subsystem for Linux (WSL): WSL uses a Microsoft-supplied kernel, but direct USB-C controller passthrough is atypical. Still, confirm with the latest WSL kernel release notes.
- Hypervisors and virtual machines: Guests with USB-C passthrough or PCIe forwarding for Type-C controllers may be reachable.
- IT administrators who manage a fleet of Linux servers, IoT appliances, or embedded devices with USB-C ports must include this in their patch cycle.

The Anatomy of a One-Line Fix

The patch is conceptually straightforward but surgically precise: move the array index boundary check inside the loop that processes each mode descriptor. Instead of trusting the pre-loop capacity assessment, every iteration now asks, “Have we filled the array?” If so, stop writing—regardless of how many VDOs the partner sent or why the function was invoked.

This shift embodies defense in depth. Even if a future code path reaches svdm_consume_modes() with an unexpected count, the array can never exceed its allocated size. The fix is already merged into the mainline kernel (starting with 7.1) and backported to stable trees.

How We Got Here: USB-C’s Protocol Complexity

USB Type-C is far more than a reversible plug. It negotiates power delivery, data roles, DisplayPort, Thunderbolt, and vendor extensions all over a single Configuration Channel (CC) wire. The Linux kernel’s TCPM implements the state machine that manages these negotiations for systems without a dedicated embedded controller.

Alternate Mode discovery—triggered when a dock or display is connected—relies on a structured exchange of SVIDs and mode descriptors. The normal flow is bounded: there are at most SVID_DISCOVERY_MAX Standard/Vendor IDs, each contributing at most MODE_DISCOVERY_MAX modes. This naturally fills the altmode_desc[] array without overflow. But the assumption breaks when a broken or malicious partner sends an unsolicited response outside that tidy sequence.

The bug’s longevity—the code dates back to the initial USB-C implementation around Linux 4.19—demonstrates a common kernel security challenge: hardware-facing protocol parsers often sit unexamined for years, trusted because the physical world “should” behave sanely. Yet USB-C accessories are active participants; they can be crafted, intercepted, or compromised to violate protocol expectations.

Practical Steps to Secure Your Systems

For individual Linux users:
1. Update your system now. Use your package manager to install the latest kernel, then reboot. Example commands:
- Debian/Ubuntu: sudo apt update && sudo apt upgrade && sudo reboot
- Fedora: sudo dnf upgrade --refresh && sudo reboot
- Arch: sudo pacman -Syu && sudo reboot
2. Verify the running kernel includes the fix. Check your distribution’s changelog or security advisory for CVE-2026-63962.
3. Be cautious with unfamiliar USB-C accessories—public chargers, docks, and adapters—until you’ve rebooted into the patched kernel.

For enterprise administrators:
- Inventory all Linux systems that have physical USB-C ports or that interact with Type-C controllers via passthrough.
- Deploy the corrected kernel packages through your configuration management system. Monitor for reboot compliance—a kernel update provides no protection until the system boots the new image.
- Review procurement policies for USB-C docks, chargers, and cables. Standardizing on trusted, vetted hardware reduces the chance of malicious accessories entering the environment.
- If you manage custom or embedded kernels, apply the upstream patch directly. Validate the build with static analysis and hardware-in-the-loop testing against the docks and peripherals your organization uses.

Incident response note: Unexplained crashes when plugging in USB-C devices could be an indicator. Preserve kernel logs (dmesg) and, if safe, isolate the accessory for analysis. Do not reconnect it to production systems.

USB-C Security Is a Shared Responsibility

This incident is a reminder that the USB-C ecosystem spans operating systems, firmware, and hardware components. While the immediate fix addresses the kernel, other layers may need attention:
- Laptop firmware/BIOS: Vendors occasionally update Type-C controller firmware for protocol bugs.
- Dock and peripheral firmware: These often have their own Power Delivery implementations.
- Physical security policies: In high-sensitivity environments, restricting the use of personal USB-C gadgets is justifiable.

There’s no need to abandon USB-C—it remains essential to modern computing—but a healthy skepticism toward unverified accessories is prudent. Treat that borrowed charger or conference-room dock with the same caution you’d apply to a random USB flash drive.

What Comes Next

Distribution maintainers are in the process of backporting the fix into their long-term support kernels. Watch for security announcements from Red Hat, Canonical, SUSE, Debian, and others over the coming days. The Linux kernel security team and researchers may also audit other stateful message handlers in the Type-C stack for similar “pre-loop check only” patterns, as the bug class is recognizable and often repeated.

For now, the single most effective action is to update and reboot your Linux machines. A tiny code change stands between your system and an attack that arrives through the very port designed to power and connect it.