CVE-2026-63960

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the wcove read rx buffer() function where the PD RX FIFO is copied into the struct pd message. This process is susceptible to a buffer overflow due to two factors. First, the USBC RXINFO RXBYTES() field can report up to 31 bytes, while struct pd message is only 30 bytes; a malicious partner transmitting a 31-byte frame can cause the loop to write one byte past the destination. Second, the regmap read() function stores a full unsigned integer at the destination pointer. When using a byte pointer msg + i, each iteration writes four bytes. In the final iteration, the high three bytes are written past the end of struct pd message, which is located on the IRQ thread's stack in wcove typec irq().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.