Количество 12
Количество 12
BDU:2026-14434
Уязвимость функции ucsi_handle_connector_change() модуля drivers/usb/typec/ucsi/ucsi.c драйвера интерфейса разъема USB Type C (UCSI) ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
CVE-2026-63958
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array.
CVE-2026-63958
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array.
CVE-2026-63958
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array.
CVE-2026-63958
usb: typec: ucsi: validate connector number in ucsi_connector_change()
CVE-2026-63958
In the Linux kernel, the following vulnerability has been resolved: u ...
GHSA-qx25-w5h5-ch8m
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array.
SUSE-SU-2026:3594-1
Security update for the Linux Kernel
SUSE-SU-2026:3810-1
Security update for the Linux Kernel
SUSE-SU-2026:3790-1
Security update for the Linux Kernel
openSUSE-SU-2026:21555-1
Security update for the Linux Kernel
ELSA-2026-500248
ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-14434 Уязвимость функции ucsi_handle_connector_change() модуля drivers/usb/typec/ucsi/ucsi.c драйвера интерфейса разъема USB Type C (UCSI) ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации | CVSS3: 7 | 0% Низкий | 4 месяца назад |
 | CVE-2026-63958 In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array. | 0% Низкий | 2 месяца назад | |
 | CVE-2026-63958 In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array. | CVSS3: 7 | 0% Низкий | 2 месяца назад |
 | CVE-2026-63958 In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array. | 0% Низкий | 2 месяца назад | |
 | CVE-2026-63958 usb: typec: ucsi: validate connector number in ucsi_connector_change() | 0% Низкий | около 2 месяцев назад | |
| CVE-2026-63958 In the Linux kernel, the following vulnerability has been resolved: u ... | 0% Низкий | 2 месяца назад | |
| GHSA-qx25-w5h5-ch8m In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array. | 0% Низкий | 2 месяца назад | |
 | SUSE-SU-2026:3594-1 Security update for the Linux Kernel | около 1 месяца назад | ||
| SUSE-SU-2026:3810-1 Security update for the Linux Kernel | 23 дня назад | ||
| SUSE-SU-2026:3790-1 Security update for the Linux Kernel | 23 дня назад | ||
| openSUSE-SU-2026:21555-1 Security update for the Linux Kernel | около 1 месяца назад | ||
| ELSA-2026-500248 ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 14 дней назад |
Уязвимостей на страницу