{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64330", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.781Z", "datePublished": "2026-07-25T08:49:57.734Z", "dateUpdated": "2026-07-25T08:49:57.734Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-25T08:49:57.734Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Validate SVID index in svdm_consume_modes()\n\nIn svdm_consume_modes(), the SVID value is read from pmdata->svids using\npmdata->svid_index as an array index without bounds validation:\n\n paltmode->svid = pmdata->svids[pmdata->svid_index];\n\nIf pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results\nin an out-of-bounds read of the pmdata->svids array. Because pd_mode_data\nis embedded inside struct tcpm_port, indexing past svids reads into\nadjacent fields. In particular:\n- At index 16, it reads the altmodes count.\n- At index 18 and beyond, it reads into altmode_desc[], which contains\n partner-supplied SVDM Discovery Modes VDOs.\n\nBy injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index\nto 20, the partner can force paltmode->svid to be loaded with an arbitrary,\npartner- chosen SVID, which is then registered via\ntypec_partner_register_altmode().\n\nFix this by validating that pmdata->svid_index is non-negative and strictly\nless than pmdata->nsvids before accessing the pmdata->svids array inside\nsvdm_consume_modes()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/tcpm/tcpm.c"], "versions": [{"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "lessThan": "89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53", "status": "affected", "versionType": "git"}, {"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "lessThan": "d638ec188e95fe60f4b01106ffd41958f8fb3c2c", "status": "affected", "versionType": "git"}, {"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "lessThan": "f8163c414de8640f2ca82ce4dc93409d4cdc2fad", "status": "affected", "versionType": "git"}, {"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "lessThan": "012406f89abc52d1d5f07aa5653b519ebf6d2407", "status": "affected", "versionType": "git"}, {"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "lessThan": "c6d2af3b217a525741c472f0ab45d7d274b8468f", "status": "affected", "versionType": "git"}, {"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "lessThan": "3e1b1ac47e8163627f159f30d80d51b914620dd4", "status": "affected", "versionType": "git"}, {"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "lessThan": "313ca06e7e224ca1dfadd5722fe71fb8bc276b8b", "status": "affected", "versionType": "git"}, {"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "lessThan": "7b681dd5fbf60b24a13c14661e5b7735759fb491", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/tcpm/tcpm.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.2-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53"}, {"url": "https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c"}, {"url": "https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad"}, {"url": "https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407"}, {"url": "https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f"}, {"url": "https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4"}, {"url": "https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b"}, {"url": "https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491"}], "title": "usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/typec/tcpm/tcpm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53", "status": "affected", "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "versionType": "git"}, {"lessThan": "d638ec188e95fe60f4b01106ffd41958f8fb3c2c", "status": "affected", "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "versionType": "git"}, {"lessThan": "f8163c414de8640f2ca82ce4dc93409d4cdc2fad", "status": "affected", "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "versionType": "git"}, {"lessThan": "012406f89abc52d1d5f07aa5653b519ebf6d2407", "status": "affected", "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "versionType": "git"}, {"lessThan": "c6d2af3b217a525741c472f0ab45d7d274b8468f", "status": "affected", "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "versionType": "git"}, {"lessThan": "3e1b1ac47e8163627f159f30d80d51b914620dd4", "status": "affected", "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "versionType": "git"}, {"lessThan": "313ca06e7e224ca1dfadd5722fe71fb8bc276b8b", "status": "affected", "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "versionType": "git"}, {"lessThan": "7b681dd5fbf60b24a13c14661e5b7735759fb491", "status": "affected", "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/typec/tcpm/tcpm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Validate SVID index in svdm_consume_modes()\n\nIn svdm_consume_modes(), the SVID value is read from pmdata->svids using\npmdata->svid_index as an array index without bounds validation:\n\n paltmode->svid = pmdata->svids[pmdata->svid_index];\n\nIf pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results\nin an out-of-bounds read of the pmdata->svids array. Because pd_mode_data\nis embedded inside struct tcpm_port, indexing past svids reads into\nadjacent fields. In particular:\n- At index 16, it reads the altmodes count.\n- At index 18 and beyond, it reads into altmode_desc[], which contains\n partner-supplied SVDM Discovery Modes VDOs.\n\nBy injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index\nto 20, the partner can force paltmode->svid to be loaded with an arbitrary,\npartner- chosen SVID, which is then registered via\ntypec_partner_register_altmode().\n\nFix this by validating that pmdata->svid_index is non-negative and strictly\nless than pmdata->nsvids before accessing the pmdata->svids array inside\nsvdm_consume_modes()."}], "id": "CVE-2026-64330", "lastModified": "2026-08-11T15:00:57.447", "metrics": {}, "published": "2026-07-25T10:17:14.673", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", "id": "2507159", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507159"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's USB Type-C subsystem (tcpm). A malicious USB-C partner device could exploit an out-of-bounds read vulnerability in the `svdm_consume_modes()` function. By manipulating the SVID (Standard or Vendor ID) index, the partner device can force the system to register an arbitrary SVID. This could potentially allow the malicious device to bypass security checks or gain unauthorized control over USB-C alternate modes."], "name": "CVE-2026-64330", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64330\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64330\nhttps://lore.kernel.org/linux-cve-announce/2026072513-CVE-2026-64330-372d@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ab8c18d4d67321cc7b660559de17511d4fc0237,89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ab8c18d4d67321cc7b660559de17511d4fc0237,d638ec188e95fe60f4b01106ffd41958f8fb3c2c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ab8c18d4d67321cc7b660559de17511d4fc0237,f8163c414de8640f2ca82ce4dc93409d4cdc2fad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ab8c18d4d67321cc7b660559de17511d4fc0237,012406f89abc52d1d5f07aa5653b519ebf6d2407)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ab8c18d4d67321cc7b660559de17511d4fc0237,c6d2af3b217a525741c472f0ab45d7d274b8468f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ab8c18d4d67321cc7b660559de17511d4fc0237,3e1b1ac47e8163627f159f30d80d51b914620dd4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ab8c18d4d67321cc7b660559de17511d4fc0237,313ca06e7e224ca1dfadd5722fe71fb8bc276b8b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ab8c18d4d67321cc7b660559de17511d4fc0237,7b681dd5fbf60b24a13c14661e5b7735759fb491)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T14:30:03.598548+00:00", "updated": "2026-08-04T14:45:03.307732+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}