CVE-2026-63960

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()

wcove_read_rx_buffer() copies the PD RX FIFO into the caller's

struct pd_message with

for (i = 0; i < USBC_RXINFO_RXBYTES(info); i++)

regmap_read(wcove->regmap, USBC_RX_DATA + i, msg + i);

which has two problems:

USBC_RXINFO_RXBYTES() is a 5-bit field (max 31) while struct pd_message

is 30 bytes (__le16 header + __le32 payload[PD_MAX_PAYLOAD], packed).

The byte count latched in RXINFO is the number of bytes the port partner

put on the wire, so a malicious partner that transmits a 31-byte frame

can drive the loop one byte past the destination if the WCOVE BMC

receiver does not enforce the PD object-count limit in hardware. The

existing FIXME flagged this as unverified.

Independently, regmap_read() takes an unsigned int * and stores a full

unsigned int at the destination. Passing the byte pointer msg + i means

each iteration writes f

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References