CVE-2026-31729

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: typec: ucsi: validate connector number in ucsi_notify_common()<br /> <br /> The connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a<br /> 7-bit field (0-127) that is used to index into the connector array in<br /> ucsi_connector_change(). However, the array is only allocated for the<br /> number of connectors reported by the device (typically 2-4 entries).<br /> <br /> A malicious or malfunctioning device could report an out-of-range<br /> connector number in the CCI, causing an out-of-bounds array access in<br /> ucsi_connector_change().<br /> <br /> Add a bounds check in ucsi_notify_common(), the central point where CCI<br /> is parsed after arriving from hardware, so that bogus connector numbers<br /> are rejected before they propagate further.