CVE-2026-64330

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

In svdm_consume_modes(), the SVID value is read from pmdata->svids using

pmdata->svid_index as an array index without bounds validation:

paltmode->svid = pmdata->svids[pmdata->svid_index];

If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results

in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data

is embedded inside struct tcpm_port, indexing past svids reads into

adjacent fields. In particular:

- At index 16, it reads the altmodes count.

- At index 18 and beyond, it reads into altmode_desc[], which contains

partner-supplied SVDM Discovery Modes VDOs.

By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index

to 20, the partner can force paltmode->svid to be loaded with an arbitrary,

partner- chosen SVID, which is then registered via

typec_partner_register_altmode().

Fix this by validating th

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References