A faulty validator in the Linux kernel’s UCSI implementation allows a malicious or malfunctioning USB Type‑C device to report a connector number outside the valid range. The kernel interprets this 7‑bit value as an index into a small array that holds only the connectors reported by the device. Without a bounds check, an out‑of‑range value causes a kernel out‑of‑bounds array access, potentially crashing the system or hijacking kernel memory. The severity is that it enables a local attacker to destabilize or possibly compromise the kernel environment.

The flaw affects all Linux kernel builds that contain the unpatched ucsi_notify_common() function. Versions prior to the commit that added the bounds check are vulnerable; exact affected subversions are not listed in the CVE data, so any distribution using a kernel older than that patch is at risk.

The CVSS score is 7.0 and the EPSS score is unavailable, making the precise exploitation probability unclear. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a local USB Type‑C device that supplies an out‑of‑range connector number, which could result in kernel crashes or, depending on the memory state, privilege escalation. While no public exploit is known, the nature of an out‑of‑bounds kernel bug warrants prompt attention.