CVE-2026-63960

usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()

Published Jul 19, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()

wcove_read_rx_buffer() copies the PD RX FIFO into the caller's
struct pd_message with

for (i = 0; i < USBC_RXINFO_RXBYTES(info); i++)
regmap_read(wcove->regmap, USBC_RX_DATA + i, msg + i);

which has two problems:

USBC_RXINFO_RXBYTES() is a 5-bit field (max 31) while struct pd_message
is 30 bytes (__le16 header + __le32 payload[PD_MAX_PAYLOAD], packed).
The byte count latched in RXINFO is the number of bytes the port partner
put on the wire, so a malicious partner that transmits a 31-byte frame
can drive the loop one byte past the destination if the WCOVE BMC
receiver does not enforce the PD object-count limit in hardware. The
existing FIXME flagged this as unverified.

Independently, regmap_read() takes an unsigned int * and stores a full
unsigned int at the destination. Passing the byte pointer msg + i means
each iteration writes four bytes; the high three are zero (val_bits is
8) and are normally overwritten by the next iteration, but the final
iteration's high bytes are not. With RXBYTES == 30 the i == 29 iteration
already writes three zero bytes past msg, which sits on the IRQ thread's
stack in wcove_typec_irq().

Clamp the loop to sizeof(struct pd_message) and read each register into
a local before storing only its low byte, so the copy can never exceed
the destination regardless of what RXINFO reports.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3c4fb9f169214290ec9a943907321e6265b36f65`	affected	< 3e632098d0521257ea965bbd6fde807d9bee5c8a
`3c4fb9f169214290ec9a943907321e6265b36f65`	affected	< f2a1edc0bd142edabc6c85d88713f2bc178dd317
`3c4fb9f169214290ec9a943907321e6265b36f65`	affected	< 6899f5b6d7b83ce79a3d331dc61dd31bf73f9c22
`3c4fb9f169214290ec9a943907321e6265b36f65`	affected	< 5cd0e7ac4eefbdb330f8c72694fe74e63df65552
`3c4fb9f169214290ec9a943907321e6265b36f65`	affected	< d0e4b8b3c6b7607a16932556eaaca5d5cf69f192
`3c4fb9f169214290ec9a943907321e6265b36f65`	affected	< e94933dc41b87503bf585c8c6d53d740620eceb9
`3c4fb9f169214290ec9a943907321e6265b36f65`	affected	< 3f9d50c8b02b4af0646aa892465080f9061fc89c
`3c4fb9f169214290ec9a943907321e6265b36f65`	affected	< 4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[3c4fb9f169214290ec9a943907321e6265b36f65,3e632098d0521257ea965bbd6fde807d9bee5c8a)`	affected	code_commit	—
`[3c4fb9f169214290ec9a943907321e6265b36f65,f2a1edc0bd142edabc6c85d88713f2bc178dd317)`	affected	code_commit	—
`[3c4fb9f169214290ec9a943907321e6265b36f65,6899f5b6d7b83ce79a3d331dc61dd31bf73f9c22)`	affected	code_commit	—
`[3c4fb9f169214290ec9a943907321e6265b36f65,5cd0e7ac4eefbdb330f8c72694fe74e63df65552)`	affected	code_commit	—
`[3c4fb9f169214290ec9a943907321e6265b36f65,d0e4b8b3c6b7607a16932556eaaca5d5cf69f192)`	affected	code_commit	—
`[3c4fb9f169214290ec9a943907321e6265b36f65,e94933dc41b87503bf585c8c6d53d740620eceb9)`	affected	code_commit	—
`[3c4fb9f169214290ec9a943907321e6265b36f65,3f9d50c8b02b4af0646aa892465080f9061fc89c)`	affected	code_commit	—
`[3c4fb9f169214290ec9a943907321e6265b36f65,4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.15`	affected	generic	—
`[0,4.15)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8903-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8904-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8905-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8903-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8905-2	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.156% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3e632098d0521257ea965bbd6fde807d9bee5c8a
https://git.kernel.org/stable/c/3f9d50c8b02b4af0646aa892465080f9061fc89c
https://git.kernel.org/stable/c/4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa
https://git.kernel.org/stable/c/5cd0e7ac4eefbdb330f8c72694fe74e63df65552
https://git.kernel.org/stable/c/6899f5b6d7b83ce79a3d331dc61dd31bf73f9c22
https://git.kernel.org/stable/c/d0e4b8b3c6b7607a16932556eaaca5d5cf69f192
https://git.kernel.org/stable/c/e94933dc41b87503bf585c8c6d53d740620eceb9
https://git.kernel.org/stable/c/f2a1edc0bd142edabc6c85d88713f2bc178dd317
https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-63960-990c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63960
https://www.cve.org/CVERecord?id=CVE-2026-63960

History

Oct 30, 2026 2:45 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Jul 26, 2026 8:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-120 CWE-787

Jul 22, 2026 12:15 AM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-805
References		https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-63960-990c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63960 https://www.cve.org/CVERecord?id=CVE-2026-63960

Jul 21, 2026 11:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-120 CWE-787

Jul 19, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() wcove_read_rx_buffer() copies the PD RX FIFO into the caller's struct pd_message with for (i = 0; i < USBC_RXINFO_RXBYTES(info); i++) regmap_read(wcove->regmap, USBC_RX_DATA + i, msg + i); which has two problems: USBC_RXINFO_RXBYTES() is a 5-bit field (max 31) while struct pd_message is 30 bytes (__le16 header + __le32 payload[PD_MAX_PAYLOAD], packed). The byte count latched in RXINFO is the number of bytes the port partner put on the wire, so a malicious partner that transmits a 31-byte frame can drive the loop one byte past the destination if the WCOVE BMC receiver does not enforce the PD object-count limit in hardware. The existing FIXME flagged this as unverified. Independently, regmap_read() takes an unsigned int * and stores a full unsigned int at the destination. Passing the byte pointer msg + i means each iteration writes four bytes; the high three are zero (val_bits is 8) and are normally overwritten by the next iteration, but the final iteration's high bytes are not. With RXBYTES == 30 the i == 29 iteration already writes three zero bytes past msg, which sits on the IRQ thread's stack in wcove_typec_irq(). Clamp the loop to sizeof(struct pd_message) and read each register into a local before storing only its low byte, so the copy can never exceed the destination regardless of what RXINFO reports.
Title		usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3e632098d0521257ea965bbd6fde807d9bee5c8a https://git.kernel.org/stable/c/3f9d50c8b02b4af0646aa892465080f9061fc89c https://git.kernel.org/stable/c/4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa https://git.kernel.org/stable/c/5cd0e7ac4eefbdb330f8c72694fe74e63df65552 https://git.kernel.org/stable/c/6899f5b6d7b83ce79a3d331dc61dd31bf73f9c22 https://git.kernel.org/stable/c/d0e4b8b3c6b7607a16932556eaaca5d5cf69f192 https://git.kernel.org/stable/c/e94933dc41b87503bf585c8c6d53d740620eceb9 https://git.kernel.org/stable/c/f2a1edc0bd142edabc6c85d88713f2bc178dd317