{"schema_version":"1.9.0","id":"CVE-2026-63958","published":"2026-07-19T14:55:48.835Z","modified":"2026-08-31T18:26:08.707874848Z","related":["SUSE-SU-2026:23066-1","SUSE-SU-2026:23068-1","SUSE-SU-2026:23193-1","SUSE-SU-2026:23194-1","SUSE-SU-2026:23221-1","SUSE-SU-2026:23231-1","SUSE-SU-2026:23237-1","SUSE-SU-2026:23241-1","SUSE-SU-2026:23244-1","SUSE-SU-2026:3594-1","SUSE-SU-2026:3790-1","SUSE-SU-2026:3810-1","openSUSE-SU-2026:21555-1"],"summary":"usb: typec: ucsi: validate connector number in ucsi_connector_change()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: validate connector number in ucsi_connector_change()\n\nThe connector number in a UCSI CCI notification is a 7-bit field\nsupplied by the PPM.  ucsi_connector_change() uses it to index the\nucsi->connector[] array without checking it against the number of\nconnectors the PPM reported at init time, so a buggy or malicious PPM\n(EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 /\nglink transports) can drive schedule_work() on memory past the end of\nthe array.\n\nReject connector numbers that are zero or exceed cap.num_connectors\nbefore dereferencing the array.","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c1b0bc2dabfa884dea49c02adaf3cd6b52b33d2f"},{"fixed":"cea949203faef9cb783adc7b978cce056271e057"},{"fixed":"156b6f0aec6108909b0c4aedc78865b12766b347"},{"fixed":"bd24d92af4ae021b6209f28e9a57e1bf2260d4fd"},{"fixed":"0edd1e21587b0483c7ceb993b9fb9668bbef7433"},{"fixed":"5af2719b460ab904c504fc069d1dd2a3aa2b22b0"},{"fixed":"288a81a8507052bcfbf884d39a463c44c42c5fd9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63958.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.13.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.93"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.35"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.12"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63958.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0edd1e21587b0483c7ceb993b9fb9668bbef7433"},{"type":"WEB","url":"https://git.kernel.org/stable/c/156b6f0aec6108909b0c4aedc78865b12766b347"},{"type":"WEB","url":"https://git.kernel.org/stable/c/288a81a8507052bcfbf884d39a463c44c42c5fd9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5af2719b460ab904c504fc069d1dd2a3aa2b22b0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bd24d92af4ae021b6209f28e9a57e1bf2260d4fd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cea949203faef9cb783adc7b978cce056271e057"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63958.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63958"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63958.json"}}