The flaw lies in the Linux kernel’s USB Type‑C transport controller code. In svdm_consume_modes(), the kernel extracts an SVID from an array using pmdata->svid_index without ensuring the index is within bounds. When an attacker sends a SVDM message that sets svid_index beyond the declared maximum of 16, the kernel performs an out‑of‑bounds read of the pmdata->svids array, exposing arbitrary memory and delivering the value to typec_partner_register_altmode(). This permits the attacker to register a custom SVID as an alternate mode, potentially enabling untrusted mode configuration and leaking data.

Affected systems are all Linux kernel users that contain the tcpm implementation before the fix. The vulnerability applies to the Linux kernel product; no specific version list is provided, so every kernel that has not yet incorporated the bounds‑check is vulnerable.

The CVSS score of 5.5 indicates moderate severity. The risk is low to moderate. The EPSS score is reported as < 1 %, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a crafted USB Type‑C message from a partner device, meaning the attacker must have physical or proximate access. While the vulnerability allows unauthorized alternate‑mode registration, it does not immediately grant code execution. Updating the kernel to a version that includes the fix is the recommended mitigation.