CVE-2026-63958

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the UCSI (USB Type-C Connector System Software Interface) component where the ucsi connector change() function fails to validate the connector number received in a UCSI CCI notification. This connector number, a 7-bit field supplied by the PPM (Platform Policy Manager), is used to index the ucsi->connector[] array. Because the value is not checked against the number of connectors reported during initialization, a malicious or buggy PPM—such as EC firmware or an I2C-attached UCSI controller on ccg, stm32g0, or glink transports—could cause schedule work() to operate on memory beyond the array boundaries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.