CVE-2026-64330: usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

In svdm_consume_modes(), the SVID value is read from pmdata->svids using
pmdata->svid_index as an array index without bounds validation:

    paltmode->svid = pmdata->svids[pmdata->svid_index];

If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results
in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data
is embedded inside struct tcpm_port, indexing past svids reads into
adjacent fields. In particular:
- At index 16, it reads the altmodes count.
- At index 18 and beyond, it reads into altmode_desc[], which contains
  partner-supplied SVDM Discovery Modes VDOs.

By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index
to 20, the partner can force paltmode->svid to be loaded with an arbitrary,
partner- chosen SVID, which is then registered via
typec_partner_register_altmode().

Fix this by validating that pmdata->svid_index is non-negative and strictly
less than pmdata->nsvids before accessing the pmdata->svids array inside
svdm_consume_modes().

The Linux kernel CVE team has assigned CVE-2026-64330 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.19 with commit 4ab8c18d4d67321cc7b660559de17511d4fc0237 and fixed in 5.10.261 with commit 89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53
	Issue introduced in 4.19 with commit 4ab8c18d4d67321cc7b660559de17511d4fc0237 and fixed in 5.15.212 with commit d638ec188e95fe60f4b01106ffd41958f8fb3c2c
	Issue introduced in 4.19 with commit 4ab8c18d4d67321cc7b660559de17511d4fc0237 and fixed in 6.1.178 with commit f8163c414de8640f2ca82ce4dc93409d4cdc2fad
	Issue introduced in 4.19 with commit 4ab8c18d4d67321cc7b660559de17511d4fc0237 and fixed in 6.6.145 with commit 012406f89abc52d1d5f07aa5653b519ebf6d2407
	Issue introduced in 4.19 with commit 4ab8c18d4d67321cc7b660559de17511d4fc0237 and fixed in 6.12.96 with commit c6d2af3b217a525741c472f0ab45d7d274b8468f
	Issue introduced in 4.19 with commit 4ab8c18d4d67321cc7b660559de17511d4fc0237 and fixed in 6.18.39 with commit 3e1b1ac47e8163627f159f30d80d51b914620dd4
	Issue introduced in 4.19 with commit 4ab8c18d4d67321cc7b660559de17511d4fc0237 and fixed in 7.1.4 with commit 313ca06e7e224ca1dfadd5722fe71fb8bc276b8b
	Issue introduced in 4.19 with commit 4ab8c18d4d67321cc7b660559de17511d4fc0237 and fixed in 7.2-rc3 with commit 7b681dd5fbf60b24a13c14661e5b7735759fb491

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64330
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/typec/tcpm/tcpm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53
	https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c
	https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad
	https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407
	https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f
	https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4
	https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b
	https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491