CVE-2026-63960

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pdmessage in wcovereadrxbuffer wcovereadrxbuffer copies the PD RX FIFO into the caller's struct pdmessage with for i = 0; i regmap, USBCRXDATA + i, msg + i; which has two problems:...

EUVD-2026-45733

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pdmessage in wcovereadrxbuffer wcovereadrxbuffer copies the PD RX FIFO into the caller's struct pdmessage with for i = 0; i regmap, USBCRXDATA + i, msg + i; which has two problems:...

CVE-2026-63960

In the Linux kernel, CVE-2026-63960 affects usb: typec: wcove by allowing wcove_read_rx_buffer() to copy the PD RX FIFO into struct pd_message beyond its bounds. The loop uses USBC_RXINFO_RXBYTES(info) (5-bit, max 31) while the destination is 30 bytes, enabling a mis-sized copy. Additionally, reg...

PT-2026-61277

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pd message in wcove read rx buffer wcove read rx buffer copies the PD RX FIFO into the caller's struct pd message with for i = 0; i regmap, USBC RX DATA + i, msg + i; which has two...