CVE-2026-64330 - Vulnerability Details

- usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

In svdm_consume_modes(), the SVID value is read from pmdata->svids using
pmdata->svid_index as an array index without bounds validation:

paltmode->svid = pmdata->svids[pmdata->svid_index];

If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results
in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data
is embedded inside struct tcpm_port, indexing past svids reads into
adjacent fields. In particular:
- At index 16, it reads the altmodes count.
- At index 18 and beyond, it reads into altmode_desc[], which contains
partner-supplied SVDM Discovery Modes VDOs.

By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index
to 20, the partner can force paltmode->svid to be loaded with an arbitrary,
partner- chosen SVID, which is then registered via
typec_partner_register_altmode().

Fix this by validating that pmdata->svid_index is non-negative and strictly
less than pmdata->nsvids before accessing the pmdata->svids array inside
svdm_consume_modes().

Published: 2026-07-25

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4ab8c18d4d67321cc7b660559de17511d4fc0237`	affected	< 89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53
`4ab8c18d4d67321cc7b660559de17511d4fc0237`	affected	< d638ec188e95fe60f4b01106ffd41958f8fb3c2c
`4ab8c18d4d67321cc7b660559de17511d4fc0237`	affected	< f8163c414de8640f2ca82ce4dc93409d4cdc2fad
`4ab8c18d4d67321cc7b660559de17511d4fc0237`	affected	< 012406f89abc52d1d5f07aa5653b519ebf6d2407
`4ab8c18d4d67321cc7b660559de17511d4fc0237`	affected	< c6d2af3b217a525741c472f0ab45d7d274b8468f
`4ab8c18d4d67321cc7b660559de17511d4fc0237`	affected	< 3e1b1ac47e8163627f159f30d80d51b914620dd4
`4ab8c18d4d67321cc7b660559de17511d4fc0237`	affected	< 313ca06e7e224ca1dfadd5722fe71fb8bc276b8b
`4ab8c18d4d67321cc7b660559de17511d4fc0237`	affected	< 7b681dd5fbf60b24a13c14661e5b7735759fb491

Linux

affected

Version	Status	Constraints
`4.19`	affected	—
`0`	unaffected	< 4.19
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4ab8c18d4d67321cc7b660559de17511d4fc0237,89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53)`	affected	code_commit	—
`[4ab8c18d4d67321cc7b660559de17511d4fc0237,d638ec188e95fe60f4b01106ffd41958f8fb3c2c)`	affected	code_commit	—
`[4ab8c18d4d67321cc7b660559de17511d4fc0237,f8163c414de8640f2ca82ce4dc93409d4cdc2fad)`	affected	code_commit	—
`[4ab8c18d4d67321cc7b660559de17511d4fc0237,012406f89abc52d1d5f07aa5653b519ebf6d2407)`	affected	code_commit	—
`[4ab8c18d4d67321cc7b660559de17511d4fc0237,c6d2af3b217a525741c472f0ab45d7d274b8468f)`	affected	code_commit	—
`[4ab8c18d4d67321cc7b660559de17511d4fc0237,3e1b1ac47e8163627f159f30d80d51b914620dd4)`	affected	code_commit	—
`[4ab8c18d4d67321cc7b660559de17511d4fc0237,313ca06e7e224ca1dfadd5722fe71fb8bc276b8b)`	affected	code_commit	—
`[4ab8c18d4d67321cc7b660559de17511d4fc0237,7b681dd5fbf60b24a13c14661e5b7735759fb491)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.19`	affected	generic	—
`[0,4.19)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407
https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b
https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4
https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491
https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53
https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f
https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c
https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad

History

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() In svdm_consume_modes(), the SVID value is read from pmdata->svids using pmdata->svid_index as an array index without bounds validation: paltmode->svid = pmdata->svids[pmdata->svid_index]; If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data is embedded inside struct tcpm_port, indexing past svids reads into adjacent fields. In particular: - At index 16, it reads the altmodes count. - At index 18 and beyond, it reads into altmode_desc[], which contains partner-supplied SVDM Discovery Modes VDOs. By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index to 20, the partner can force paltmode->svid to be loaded with an arbitrary, partner- chosen SVID, which is then registered via typec_partner_register_altmode(). Fix this by validating that pmdata->svid_index is non-negative and strictly less than pmdata->nsvids before accessing the pmdata->svids array inside svdm_consume_modes().
Title		usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407 https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4 https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491 https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53 https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:57.734Z

Updated: 2026-07-25T08:49:57.734Z

Reserved: 2026-07-19T15:36:31.781Z

Link: CVE-2026-64330

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-25T14:30:03Z

Weaknesses

No weakness.

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object