In the Linux kernel, the following vulnerability has been resolved:

usb: typec: altmodes/displayport: validate count before reading Status Update VDO

A broken/malicious device can send the incorrect count for a status
update VDO, which will cause the kernel to read uninitialized stack data
and send it off elsewhere.

Fix this up by correctly verifying the count for the update object.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 affected < 74aabe9ea30fdfba924fce9594e6aa69a596a4bb
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 affected < dd7118c010f324497c275e8fd7a35c9baaa2a00f
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 affected < 6ffdbcd7a02f3af8fff9b6519830369f574ed44c
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 affected < 70e7045849e954e56dcbf441b6330e66bc996306
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 affected < 64bd6ccc5799f8473d1f37d4d8f53093dfec5c02
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 affected < b10eff5abe6aa2a5af10ed17bddff76e3b6e6b9b
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 affected < 77a759ec30bc5fb0dd9c867b711d0acfed6c7faa
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 affected < 8a18f896e667df491331371b55d4ad644dc51d60
Linux Linux affected
Version Status Constraints
4.19 affected —
0 unaffected < 4.19
5.10.259 unaffected ≤ 5.10.*
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.93 unaffected ≤ 6.12.*
6.18.35 unaffected ≤ 6.18.*
7.0.12 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/64bd6ccc5799f8473d1f37d4d8f53093dfec5c02 cve-icon
https://git.kernel.org/stable/c/6ffdbcd7a02f3af8fff9b6519830369f574ed44c cve-icon
https://git.kernel.org/stable/c/70e7045849e954e56dcbf441b6330e66bc996306 cve-icon
https://git.kernel.org/stable/c/74aabe9ea30fdfba924fce9594e6aa69a596a4bb cve-icon
https://git.kernel.org/stable/c/77a759ec30bc5fb0dd9c867b711d0acfed6c7faa cve-icon
https://git.kernel.org/stable/c/8a18f896e667df491331371b55d4ad644dc51d60 cve-icon
https://git.kernel.org/stable/c/b10eff5abe6aa2a5af10ed17bddff76e3b6e6b9b cve-icon
https://git.kernel.org/stable/c/dd7118c010f324497c275e8fd7a35c9baaa2a00f cve-icon
History

Sun, 19 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and send it off elsewhere. Fix this up by correctly verifying the count for the update object.
Title usb: typec: altmodes/displayport: validate count before reading Status Update VDO
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-20T06:41:41.563Z

Reserved: 2026-07-19T07:54:57.023Z

Link: CVE-2026-63961

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.