The wcove USB Type‑C driver mistakenly copies received PD messages into a struct that is too small, and the read routine writes four bytes for each byte read. If a partner device transmits a malformed 31‑byte frame, the loop writes one byte past the buffer, and the final iteration writes three zero bytes beyond the stack allocation. This out‑of‑bounds write can corrupt the IRQ thread’s stack, potentially allowing an attacker to execute arbitrary code with a classic buffer overflow that violates memory bounds enforcement.

All Linux kernel configurations that include the wcove USB Type‑C driver are potentially affected. The vulnerability exists in kernel releases 7.1 RC1 through RC5 and any other kernel versions that contain the same driver code before the patch.

The EPSS score of less than 1% indicates a very low probability of exploitation in the current threat landscape, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 places the vulnerability in the medium severity range, but because it is a kernel buffer overflow, the severity of a successful exploit would still be high, enabling arbitrary code execution. Attackers would likely need to supply a specially crafted PD message via a connected USB‑C partner device. Based on the description, this is inferred to be a device‑side or local attacker scenario. In the absence of an active exploit, the risk is primarily the potential for future exploitation if the flaw is leveraged.