The wcove USB Type‑C driver mistakenly copies received PD messages into a struct that is too small, and the read routine writes four bytes for each byte read. If a partner device transmits a malformed 31‑byte frame, the loop writes one byte past the buffer, and the final iteration writes three zero bytes beyond the stack allocation. This out‑of‑bounds write can corrupt the IRQ thread’s stack, potentially allowing an attacker to execute arbitrary code with a classic buffer overflow that violates memory bounds enforcement.

All Linux kernel configurations that include the wcove USB Type‑C driver are potentially affected. No specific kernel releases are identified, and the driver code is vulnerable until the patch is applied.

The EPSS score of less than 1% indicates a very low probability of exploitation in the current threat landscape, and the vulnerability is not listed in the CISA KEV catalog. However, because it is a kernel buffer overflow, the severity of a successful exploit would be high, enabling arbitrary code execution. Attackers would likely need to supply a specially crafted PD message via a connected USB‑C partner device. Based on the description, this is inferred to be a device‑side or local attacker scenario. In the absence of an active exploit, the risk is primarily the potential for future exploitation if the flaw is leveraged.