GHSA-5X5W-F8X6-M8WF

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

In svdm_consume_modes(), the SVID value is read from pmdata->svids using pmdata->svid_index as an array index without bounds validation:

paltmode->svid = pmdata->svids[pmdata->svid_index];

If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data is embedded inside struct tcpm_port, indexing past svids reads into adjacent fields. In particular: - At index 16, it reads the altmodes count. - At index 18 and beyond, it reads into altmode_desc[], which contains partner-supplied SVDM Discovery Modes VDOs.

By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index to 20, the partner can force paltmode->svid to be loaded with an arbitrary, partner- chosen SVID, which is then registered via typec_partner_register_altmode().

Fix this by validating that pmdata->svid_index is non-negative and strictly less than pmdata->nsvids before accessing the pmdata->svids array inside svdm_consume_modes().

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-64330"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:14Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Validate SVID index in svdm_consume_modes()\n\nIn svdm_consume_modes(), the SVID value is read from pmdata-\u003esvids using\npmdata-\u003esvid_index as an array index without bounds validation:\n\n    paltmode-\u003esvid = pmdata-\u003esvids[pmdata-\u003esvid_index];\n\nIf pmdata-\u003esvid_index is driven beyond SVID_DISCOVERY_MAX (16), it results\nin an out-of-bounds read of the pmdata-\u003esvids array. Because pd_mode_data\nis embedded inside struct tcpm_port, indexing past svids reads into\nadjacent fields. In particular:\n- At index 16, it reads the altmodes count.\n- At index 18 and beyond, it reads into altmode_desc[], which contains\n  partner-supplied SVDM Discovery Modes VDOs.\n\nBy injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index\nto 20, the partner can force paltmode-\u003esvid to be loaded with an arbitrary,\npartner- chosen SVID, which is then registered via\ntypec_partner_register_altmode().\n\nFix this by validating that pmdata-\u003esvid_index is non-negative and strictly\nless than pmdata-\u003ensvids before accessing the pmdata-\u003esvids array inside\nsvdm_consume_modes().",
  "id": "GHSA-5x5w-f8x6-m8wf",
  "modified": "2026-07-25T12:31:31Z",
  "published": "2026-07-25T12:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64330"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.