Not yet scoredPublished Jul 19, 2026

CVE-2026-63961usb: typec: altmodes/displayport: validate count before reading Status Update VDO

Updated under an hour ago (Oct 28, 2026, 12:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and send it off elsewhere. Fix this up by correctly verifying the count for the update object.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Jul 20, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 before 74aabe9ea30fdfba924fce9594e6aa69a596a4bb; from 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 before dd7118c010f324497c275e8fd7a35c9baaa2a00f; from 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 before 6ffdbcd7a02f3af8fff9b6519830369f574ed44c; from 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 before 70e7045849e954e56dcbf441b6330e66bc996306; from 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 before 64bd6ccc5799f8473d1f37d4d8f53093dfec5c02; from 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 before b10eff5abe6aa2a5af10ed17bddff76e3b6e6b9b; from 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 before 77a759ec30bc5fb0dd9c867b711d0acfed6c7faa; from 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 before 8a18f896e667df491331371b55d4ad644dc51d60	CNA record

References

References

https://git.kernel.org/stable/c/74aabe9ea30fdfba924fce9594e6aa69a596a4bb
https://git.kernel.org/stable/c/dd7118c010f324497c275e8fd7a35c9baaa2a00f
https://git.kernel.org/stable/c/6ffdbcd7a02f3af8fff9b6519830369f574ed44c
https://git.kernel.org/stable/c/70e7045849e954e56dcbf441b6330e66bc996306
https://git.kernel.org/stable/c/64bd6ccc5799f8473d1f37d4d8f53093dfec5c02
https://git.kernel.org/stable/c/b10eff5abe6aa2a5af10ed17bddff76e3b6e6b9b
https://git.kernel.org/stable/c/77a759ec30bc5fb0dd9c867b711d0acfed6c7faa
https://git.kernel.org/stable/c/8a18f896e667df491331371b55d4ad644dc51d60

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.