CVE-2026-63964

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the do flash() function within the USB Type-C UCSI CCG component. The function attempts to locate the first .cyacd record using strnchr(). If a firmware image lacks a : record header, strnchr() returns NULL. Because NULL is compared as being less than the eof kernel pointer, the loop executes and calls strnchr() with an invalid pointer, leading to a system crash (oops). A root user can trigger this by placing a crafted unsigned firmware file in /lib/firmware and writing to the do flash sysfs attribute.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.