During the handling of USB Type‑C Power Delivery frames, the TCPCI Maxim driver in the Linux kernel fails to verify that the number of data objects advertised in a frame’s header matches the number of bytes actually received. As a consequence, when a frame advertises up to seven data objects while carrying fewer bytes, the driver reads from uninitialized stack memory while parsing the frame. This flaw can leak kernel memory contents to an attacker, potentially revealing sensitive information. The weakness is a classic input‑validation failure that exposes uninitialized data, reflected in the CWE‑130 identifier provided by the CNA.

The flaw is present in the TCPCI Maxim driver packaged with the Linux kernel. All kernels that include this driver—specifically the usb:typec:tcpm subsystem—are vulnerable until the relevant patch is applied. Because no specific kernel versions are listed, any kernel containing the unpatched driver is at risk.

An attacker must be able to transmit a crafted USB Type‑C frame to the host, which typically requires physical proximity to a USB‑Type C port or an intermediary device that can send the frame. The EPSS score of less than 1% indicates a very low probability of observed exploitation. The vulnerability is not listed in CISA’s KEV catalog, and the flaw does not provide direct code execution; it primarily poses an information‑disclosure risk, though it could be leveraged as a foothold in a larger attack chain. The overall risk is moderate but warrants timely remediation.