USB-C Chargers Could Leak Your Linux PC’s Memory—The Kernel Fix Is Here

Linux kernel maintainers disclosed a vulnerability on July 19, 2026, that could let a malicious USB-C charger or dock read uninitialized stack memory from your machine. The flaw, tagged CVE-2026-63959, resides in the Maxim TCPCI USB Type-C port controller driver and affects systems running Linux when exposed to a specially crafted USB Power Delivery message. Updated kernels that patch the hole are already available.

What the Patch Actually Fixes

The bug lives in drivers/usb/typec/tcpm/tcpci_maxim_core.c, a driver used for certain Maxim Integrated (now Analog Devices) USB-C port controllers. When a USB Power Delivery (PD) message arrives, the header declares how many data objects it contains—up to seven, each four bytes. The driver was trusting that header count without checking against the actual number of bytes received (RX_BYTE_CNT).

A malicious or malfunctioning partner device can send a CRC-valid frame whose header says it has several data objects, but the payload stops short. Without the fix, the kernel would happily attempt to read those missing objects from uninitialized stack memory. The corrected code now compares the two counts and flatly rejects any inconsistent message.

“A CRC-valid frame does not mean the frame is semantically valid,” the kernel advisory notes. “The header’s object count must match the received data length.”

The fix is surgically precise: it adds one validation check at the boundary where hardware input meets kernel parsing. No broad changes to Type-C policy handling, no risk of breaking compliant chargers or docks.

Who Really Needs to Update

This is not a vulnerability in every Linux box with a USB-C port. You are affected only if your hardware uses a Maxim TCPCI controller that loads the tcpci_maxim driver, and if an attacker can connect a malicious device to that port.

Many laptops, single-board computers, embedded devices, and developer kits use Maxim controllers, but not all do. Simply running uname -r tells you the kernel version, not whether your USB-C hardware is vulnerable. Check loaded modules:

lsmod | grep tcpci_maxim

If the module isn’t loaded, your USB-C ports are likely using a different driver and are not exposed to CVE-2026-63959. If it is loaded, you need to update—especially if the machine travels, uses public chargers, or sits in shared spaces.

Fixed Kernel Releases

The patch has been backported to the following stable kernel series. Systems running these versions or later are protected:

If your distribution ships an older version with a backported fix, you’re safe too. Check your vendor’s security advisory—don’t rely on version numbers alone.

How an Attack Would Play Out

To exploit this, an attacker needs physical access to your USB-C port, either directly or through a compromised accessory. They can’t trigger the bug remotely over the internet. The most likely scenarios:

• A rigged charging kiosk at an airport or conference.
• A tampered dock or monitor in a shared workspace.
• A counterfeit cable with an embedded microcontroller.
• A supply-chain compromised peripheral that looks legitimate.

Once connected, the malicious device sends a USB PD message with a deceptive object count. The vulnerable kernel reads stale stack data, which might contain anything from kernel pointers to cryptographic remnants, depending on timing and memory layout.

The NVD record, as of July 21, 2026, assigns no CVSS score and lists no known active exploits. Don’t interpret that as “safe to ignore.” A patch exists, the attack surface is well-defined, and waiting for a proof-of-concept to circulate is never a good strategy.

What to Do Right Now

For Individual Linux Users

• Update your kernel through your distribution’s package manager (e.g., sudo apt upgrade on Debian/Ubuntu, sudo dnf update on Fedora, or a pacman -Syu on Arch).
• Reboot into the new kernel.
• If your distro hasn’t packaged the fix yet, consider switching to a supported kernel stream or limiting use of unknown USB-C accessories.
• Test charging, docking, and display output after the update—if a previously working accessory suddenly fails, it may have been sending malformed PD messages and is now correctly rejected.

For Enterprise IT Teams

• Audit Linux endpoints with USB-C ports, focusing on developer laptops, lab equipment, and kiosks.
• Identify hardware that uses the Maxim controller; ask vendors or check device trees.
• Push kernel updates through your configuration management pipeline, and validate dock and charger functionality post-patch.
• Establish a hardware accessory policy that treats USB-C chargers and docking stations as security-relevant, not just commodity items.

For Embedded and Custom Linux Deployments

• Verify whether your board’s BSP (board support package) includes the tcpci_maxim driver.
• If yes, backport the fix or update to a patched kernel release, then regression-test against the chargers and peripherals you ship or support.
• Document the updated kernel version in your next firmware release notes for customers.

What This Means for Windows Users

CVE-2026-63959 is entirely a Linux kernel bug. Windows, Windows Server, and Windows Subsystem for Linux (WSL) are not directly vulnerable. WSL runs Linux kernels inside a virtualized environment without passthrough control of the host’s USB-C port controller, so it cannot be exploited from within WSL.

However, the same physical accessories—chargers, docks, cables—are used across Windows and Linux devices. A malicious USB-C device could be used against a Linux machine, while the Windows PC next to it is unaffected. The takeaway for Windows shops: you don’t need to patch Windows, but you should be aware that shared hardware can be a threat vector for Linux systems in your fleet. Include Linux kernel patching in your cross-platform security hygiene.

Why USB-C Security Keeps Getting Tougher

The USB Type-C port is no longer just a peripheral connector. It negotiates power delivery up to 240W, switches display alternate modes, tunnels USB4 and Thunderbolt, and reconfigures roles on the fly. All that negotiation happens at the protocol layer before any data transfer—meaning your operating system is parsing complex structured messages from a device that might be hostile long before you see a file or a notification.

Linux’s Type-C stack evolved in layers: the Type-C Port Manager (TCPM) handles policy, while drivers like tcpci_maxim talk to the hardware over I2C. The flawed validation sat at the boundary where raw bytes from the controller are turned into kernel objects. It’s a classic driver-security blind spot: trust the metal too much.

Previous USB-C vulnerabilities often involved DMA attacks through Thunderbolt, or issues in UCSI (USB Type-C Connector System Software Interface) mailbox commands. This one is simpler and more subtle—a parser bug that reads its own stack garbage. But the potential for information disclosure is real, and it should remind us that every external interface that accepts structured input needs the same paranoid validation as a network socket.

The Silver Lining

• The patch is minimal and unlikely to cause regressions.
• It was quickly backported to several stable kernel branches, so most distributions can roll it out without a major version jump.
• No active exploitation has been spotted in the wild, giving administrators a window to react.
• The bug itself is a teachable moment: CRC integrity checks are not a replacement for bounds checking, and kernel drivers should never trust hardware metadata more than the actual data length.

What to Watch Next

Keep an eye on your Linux distribution’s security advisories. Vendors often assign their own severity scores and publish specific package versions that contain the fix. For embedded users, watch for board manufacturer announcements—many will need to merge the patch into their own kernel forks.

Security researchers may soon publish technical deep-dives or even proof-of-concept tools. That’s not a cause for panic; it’s a signal to finish patching. The gap between CVE publication and proof-of-concept release tends to be short.

Finally, expect more scrutiny of the Linux USB-C stack. As USB-C adoption deepens in servers, IoT, automotive, and industrial gear, the number of devices whose safety depends on correct message parsing will only grow. CVE-2026-63959 is a small but important fix in that larger effort.