The Linux kernel's Type‑C USB power delivery implementation lacks validation of the Count field in a Discover Identity ACK message. An attacker‑controlled device can send a count that exceeds the bounds of internal static arrays, causing an out‑of‑bounds read that may leak kernel memory. This vulnerability is an out‑of‑bounds read (CWE‑125) that can expose confidential data stored in kernel space.

This flaw affects all Linux kernel builds that include the tcpm driver, which is enabled on any system supporting USB Type‑C power delivery. It is present in any kernel version containing the original tcpm source code; no specific release numbers are listed, so all affected kernels require the patch.

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating that active exploitation is unlikely and the overall probability of attack is low. The CVSS score of 5.5 denotes a medium severity risk. However, the exploit requires a malicious USB Type‑C device that sends a crafted Discover Identity ACK. An attacker could read leaked kernel memory, compromising confidentiality. The risk is considered modest but warrants mitigation due to the potential for data leakage.