CVE-2026-63964

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: ccg: reject firmware images without a ':' record header

do_flash() locates the first .cyacd record with

p = strnchr(fw->data, fw->size, ':');

while (p < eof) {

s = strnchr(p + 1, eof - p - 1, ':');

...

}

If the firmware image contains no ':' byte, strnchr() returns NULL.

NULL compares less than the valid kernel pointer eof, so the loop body

runs and strnchr() is called with p + 1 == (void *)1 and a length of

roughly (unsigned long)eof, causing a wonderful crash.

The not_signed_fw fallthrough earlier in do_flash() and the chip-state

branches in ccg_fw_update_needed() allow an unsigned blob to reach this

loop, so a root user who can place a crafted file under /lib/firmware

and write the do_flash sysfs attribute can trigger the oops.

Bail out with -EINVAL when the initial strnchr() returns NULL.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References