The Linux kernel’s UCSI driver does not validate the connector number received in a UCSI CCI notification before using it to index the ucsi->connector[] array, allowing a buggy or malicious Power Path Manager to provide an out‑of‑range value that causes schedule_work() to execute past the end of the array. This memory corruption can lead to kernel arbitrary code execution or denial of service.

All Linux kernel builds that include UCSI support and have not incorporated the fix are affected; this encompasses any kernel using the type‑C UCSI driver as part of the USB subsystem before the patch that adds bounds checking, as well as custom or older builds with unpatched code.

The CVSS score of 7.0 reflects a high severity, and the EPSS score of less than 1 % indicates a low likelihood of exploitation at present; the vulnerability is not listed in CISA KEV. Exploitation would require a buggy or malicious PPM capable of sending an out‑of‑range connector number, typically needing physical access to the UCSI firmware or control over the I²C bus, and could enable kernel privilege escalation if successful.