CVE-2026-31729

Root

Cause

The vulnerability resides in the Linux kernel's USB Type-C UCSI (USB Type-C Connector System Software Interface) driver. The ucsi_notify_common() function parses the Connector Change Indicator (CCI) from hardware and extracts a connector number using the UCSI_CCI_CONNECTOR() macro. This 7-bit field (0–127) is then used to index into the connector array in ucsi_connector_change(). However, the array is allocated only for the number of connectors reported by the device (typically 2–4 entries). No validation is performed on the connector number before the array access, leading to an out-of-bounds read/write when a malicious or malfunctioning device supplies an out-of-range value [1].

Exploitation

An attacker with physical access to a USB-C port can connect a specially crafted USB-C device or a malicious USB-C controller that reports a bogus connector number in the CCI. No authentication is required; the attack is triggered automatically when the kernel processes the notification from the device. The vulnerability is reachable from the ucsi_notify_common() function, which is the central point where CCI data is parsed after arriving from hardware [2].

Impact

Successful exploitation results in an out-of-bounds array access in ucsi_connector_change(). This can corrupt kernel memory, potentially leading to a system crash (denial of service) or, under the right conditions, arbitrary code execution with kernel privileges. The CVSS v3 score of 7.8 (High) reflects the high impact on confidentiality, integrity, and availability, given the local physical attack vector and low complexity [3].

Mitigation

The fix adds a bounds check in ucsi_notify_common() to reject connector numbers that exceed the number of connectors reported by the connectors reported by the device. The patch has been applied to the Linux kernel stable tree and is available in commits such as f4e608fe12b7 and d2d8c17ac01a [4]. Users should update their kernel to a version containing the fix. No workaround is available; the vulnerability is eliminated only by applying the patch.