https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:19:34 +0000 https://vulnerability.circl.lu/vuln/cve-2026-63964 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>usb: typec: ucsi: ccg: reject firmware images without a &#39;:&#39; record header</p> <p>do_flash() locates the first .cyacd record with</p> <p>p = strnchr(fw-&gt;data, fw-&gt;size, &#39;:&#39;); while (p &lt; eof) { s = strnchr(p + 1, eof - p - 1, &#39;:&#39;); ... }</p> <p>If the firmware image contains no &#39;:&#39; byte, strnchr() returns NULL. NULL compares less than the valid kernel pointer eof, so the loop body runs and strnchr() is called with p + 1 == (void *)1 and a length of roughly (unsigned long)eof, causing a wonderful crash.</p> <p>The not_signed_fw fallthrough earlier in do_flash() and the chip-state branches in ccg_fw_update_needed() allow an unsigned blob to reach this loop, so a root user who can place a crafted file under /lib/firmware and write the do_flash sysfs attribute can trigger the oops.</p> <p>Bail out with -EINVAL when the initial strnchr() returns NULL.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>usb: typec: ucsi: ccg: reject firmware images without a &#39;:&#39; record header</p> <p>do_flash() locates the first .cyacd record with</p> <p>p = strnchr(fw-&gt;data, fw-&gt;size, &#39;:&#39;); while (p &lt; eof) { s = strnchr(p + 1, eof - p - 1, &#39;:&#39;); ... }</p> <p>If the firmware image contains no &#39;:&#39; byte, strnchr() returns NULL. NULL compares less than the valid kernel pointer eof, so the loop body runs and strnchr() is called with p + 1 == (void *)1 and a length of roughly (unsigned long)eof, causing a wonderful crash.</p> <p>The not_signed_fw fallthrough earlier in do_flash() and the chip-state branches in ccg_fw_update_needed() allow an unsigned blob to reach this loop, so a root user who can place a crafted file under /lib/firmware and write the do_flash sysfs attribute can trigger the oops.</p> <p>Bail out with -EINVAL when the initial strnchr() returns NULL.</p> https://vulnerability.circl.lu/vuln/cve-2026-63964