CVE-2026-63964 (GCVE-0-2026-63964)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-07-20 06:41
VLAI
Title
usb: typec: ucsi: ccg: reject firmware images without a ':' record header
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header do_flash() locates the first .cyacd record with p = strnchr(fw->data, fw->size, ':'); while (p < eof) { s = strnchr(p + 1, eof - p - 1, ':'); ... } If the firmware image contains no ':' byte, strnchr() returns NULL. NULL compares less than the valid kernel pointer eof, so the loop body runs and strnchr() is called with p + 1 == (void *)1 and a length of roughly (unsigned long)eof, causing a wonderful crash. The not_signed_fw fallthrough earlier in do_flash() and the chip-state branches in ccg_fw_update_needed() allow an unsigned blob to reach this loop, so a root user who can place a crafted file under /lib/firmware and write the do_flash sysfs attribute can trigger the oops. Bail out with -EINVAL when the initial strnchr() returns NULL.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 , < b41dfc033fe594e152648050e95b9489cd53e9e3 (git)
Affected: 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 , < 2f395ca1263bd181995eb829f5943a83a20db213 (git)
Affected: 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 , < 6526f8684f72391138353642af908803ba70795e (git)
Affected: 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 , < 3f432b8203066c26770fe6ea591361f10021dd6b (git)
Affected: 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 , < c4ee519b06389e59ba2d6aa722fcc4a02a8bbcbb (git)
Affected: 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 , < a38ed87818b2419090fb1a6338ddce6842b65dfa (git)
Affected: 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 , < c8460de584fe5415d212cfdd127d4db90835a450 (git)
Affected: 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 , < d7486952bf74e546ee3748fb14b2d07881fa6273 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi_ccg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b41dfc033fe594e152648050e95b9489cd53e9e3",
              "status": "affected",
              "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
              "versionType": "git"
            },
            {
              "lessThan": "2f395ca1263bd181995eb829f5943a83a20db213",
              "status": "affected",
              "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
              "versionType": "git"
            },
            {
              "lessThan": "6526f8684f72391138353642af908803ba70795e",
              "status": "affected",
              "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
              "versionType": "git"
            },
            {
              "lessThan": "3f432b8203066c26770fe6ea591361f10021dd6b",
              "status": "affected",
              "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
              "versionType": "git"
            },
            {
              "lessThan": "c4ee519b06389e59ba2d6aa722fcc4a02a8bbcbb",
              "status": "affected",
              "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
              "versionType": "git"
            },
            {
              "lessThan": "a38ed87818b2419090fb1a6338ddce6842b65dfa",
              "status": "affected",
              "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
              "versionType": "git"
            },
            {
              "lessThan": "c8460de584fe5415d212cfdd127d4db90835a450",
              "status": "affected",
              "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
              "versionType": "git"
            },
            {
              "lessThan": "d7486952bf74e546ee3748fb14b2d07881fa6273",
              "status": "affected",
              "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi_ccg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: ccg: reject firmware images without a \u0027:\u0027 record header\n\ndo_flash() locates the first .cyacd record with\n\n\tp = strnchr(fw-\u003edata, fw-\u003esize, \u0027:\u0027);\n\twhile (p \u003c eof) {\n\t\ts = strnchr(p + 1, eof - p - 1, \u0027:\u0027);\n\t\t...\n\t}\n\nIf the firmware image contains no \u0027:\u0027 byte,  strnchr() returns NULL.\nNULL compares less than the valid kernel pointer eof, so the loop body\nruns and strnchr() is called with p + 1 == (void *)1 and a length of\nroughly (unsigned long)eof, causing a wonderful crash.\n\nThe not_signed_fw fallthrough earlier in do_flash() and the chip-state\nbranches in ccg_fw_update_needed() allow an unsigned blob to reach this\nloop, so a root user who can place a crafted file under /lib/firmware\nand write the do_flash sysfs attribute can trigger the oops.\n\nBail out with -EINVAL when the initial strnchr() returns NULL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T06:41:45.132Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b41dfc033fe594e152648050e95b9489cd53e9e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f395ca1263bd181995eb829f5943a83a20db213"
        },
        {
          "url": "https://git.kernel.org/stable/c/6526f8684f72391138353642af908803ba70795e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f432b8203066c26770fe6ea591361f10021dd6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4ee519b06389e59ba2d6aa722fcc4a02a8bbcbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/a38ed87818b2419090fb1a6338ddce6842b65dfa"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8460de584fe5415d212cfdd127d4db90835a450"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7486952bf74e546ee3748fb14b2d07881fa6273"
        }
      ],
      "title": "usb: typec: ucsi: ccg: reject firmware images without a \u0027:\u0027 record header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63964",
    "datePublished": "2026-07-19T14:55:53.115Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-07-20T06:41:45.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63964",
      "date": "2026-09-21",
      "epss": "0.00211",
      "percentile": "0.11588"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-21T01:03:23.000Z",
      "cve": "CVE-2026-63964",
      "id": "msrc_CVE-2026-63964",
      "initial_release_date": "2026-07-21T01:03:23.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: typec: ucsi: ccg: reject firmware images without a \u0027:\u0027 record header",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63964.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/typec/ucsi/ucsi_ccg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b41dfc033fe594e152648050e95b9489cd53e9e3",
                    "status": "affected",
                    "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2f395ca1263bd181995eb829f5943a83a20db213",
                    "status": "affected",
                    "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6526f8684f72391138353642af908803ba70795e",
                    "status": "affected",
                    "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3f432b8203066c26770fe6ea591361f10021dd6b",
                    "status": "affected",
                    "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c4ee519b06389e59ba2d6aa722fcc4a02a8bbcbb",
                    "status": "affected",
                    "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a38ed87818b2419090fb1a6338ddce6842b65dfa",
                    "status": "affected",
                    "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c8460de584fe5415d212cfdd127d4db90835a450",
                    "status": "affected",
                    "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d7486952bf74e546ee3748fb14b2d07881fa6273",
                    "status": "affected",
                    "version": "5c9ae5a87573d38cfc4c740aafda2fa6ce06e401",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/typec/ucsi/ucsi_ccg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: ccg: reject firmware images without a \u0027:\u0027 record header\n\ndo_flash() locates the first .cyacd record with\n\n\tp = strnchr(fw-\u003edata, fw-\u003esize, \u0027:\u0027);\n\twhile (p \u003c eof) {\n\t\ts = strnchr(p + 1, eof - p - 1, \u0027:\u0027);\n\t\t...\n\t}\n\nIf the firmware image contains no \u0027:\u0027 byte,  strnchr() returns NULL.\nNULL compares less than the valid kernel pointer eof, so the loop body\nruns and strnchr() is called with p + 1 == (void *)1 and a length of\nroughly (unsigned long)eof, causing a wonderful crash.\n\nThe not_signed_fw fallthrough earlier in do_flash() and the chip-state\nbranches in ccg_fw_update_needed() allow an unsigned blob to reach this\nloop, so a root user who can place a crafted file under /lib/firmware\nand write the do_flash sysfs attribute can trigger the oops.\n\nBail out with -EINVAL when the initial strnchr() returns NULL."
          }
        ],
        "id": "CVE-2026-63964",
        "lastModified": "2026-07-30T14:51:11.223",
        "metrics": {},
        "published": "2026-07-19T16:17:15.370",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2f395ca1263bd181995eb829f5943a83a20db213"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3f432b8203066c26770fe6ea591361f10021dd6b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6526f8684f72391138353642af908803ba70795e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a38ed87818b2419090fb1a6338ddce6842b65dfa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b41dfc033fe594e152648050e95b9489cd53e9e3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c4ee519b06389e59ba2d6aa722fcc4a02a8bbcbb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c8460de584fe5415d212cfdd127d4db90835a450"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d7486952bf74e546ee3748fb14b2d07881fa6273"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-21T17:00:28+00:00",
      "cve": "CVE-2026-63964",
      "id": "CVE-2026-63964",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: typec: ucsi: ccg: reject firmware images without a \u0027:\u0027 record header",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63964.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:45:43Z",
      "cve": "CVE-2026-63964",
      "id": "CVE-2026-63964",
      "initial_release_date": "2026-07-21T13:02:37Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "578",
      "product_status:known_not_affected": "143",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63964",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63964.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.