CVE-2026-63961

usb: typec: altmodes/displayport: validate count before reading Status Update VDO

published July 19, 2026

CVSS
—
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: altmodes/displayport: validate count before reading Status Update VDO

A broken/malicious device can send the incorrect count for a status

update VDO, which will cause the kernel to read uninitialized stack data

and send it off elsewhere.

Fix this up by correctly verifying the count for the update object.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.5th percentile
Published
2026-07-19T14:55Z
EPSS history
Timeline
  • 19 JUL 14:55Z
    usb: typec: altmodes/displayport: validate count before reading Status Update VDO
    cvelistv5