The Linux kernel’s svdm_consume_modes() routine inaccurately enforces boundary checks for the altmode_desc[] array. An attacker can send an oversized Discover Modes ACK containing more VDOs than expected, causing the loop to write past the end of altmode_desc[]. This out‑of‑bounds write corrupts adjacent kernel memory, including partner_altmode[] pointers, potentially allowing the attacker to overwrite critical data structures. The flaw is a classic memory corruption issue that falls under CWE‑787. Exploitation could lead to arbitrary code execution or a kernel crash, granting the attacker elevated privileges.

Affected systems include any Linux kernel installation that exposes the USB Type‑C Alternate Mode discovery path. The CNA data lists only the Linux kernel vendor without specifying a version range, indicating that the issue may exist in multiple kernel branches until the bound‑check change is merged and propagated in a release.

The CVSS score of 7.0 reflects a moderate severity, while the EPSS score of less than 1 % and absence from the CISA KEV catalog suggest a currently low exploitation likelihood. The most plausible attack vector is a malicious USB Type‑C device that sends an oversized Discover Modes ACK to a host running a vulnerable kernel. If successfully leveraged, the out‑of‑bounds write could result in privilege escalation or arbitrary code execution at the kernel level.