https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 22:11:11 +0000 https://vulnerability.circl.lu/vuln/cve-2026-63958 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>usb: typec: ucsi: validate connector number in ucsi_connector_change()</p> <p>The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi-&gt;connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array.</p> <p>Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>usb: typec: ucsi: validate connector number in ucsi_connector_change()</p> <p>The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi-&gt;connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array.</p> <p>Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array.</p> https://vulnerability.circl.lu/vuln/cve-2026-63958