CVE-2026-63963

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the USB Type-C TCPM (TCP Connection Manager) component where the count passed from a device is not properly validated when calling the svdm consume identity() or svdm consume identity sop prime() functions. A device-controlled value could cause an out-of-bounds index on static arrays, potentially leading to data leakage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.