CVE-2026-63962

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: bound altmodedesc[] per iteration in svdmconsume_modes()

svdmconsumemodes() checks pmdata->altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop.

In the well-behaved SVDM discovery flow this is harmless because each of at most SVIDDISCOVERYMAX SVIDs contributes at most MODEDISCOVERYMAX modes, exactly filling altmodedesc[ALTMODEDISCOVERYMAX]. But the CMDTRSPACK handler in tcpmpdsvdm() does not correlate an incoming ACK with any request the port actually sent. Once port->partner is set, an unsolicited Discover Modes ACK is consumed unconditionally. A broken or malicious port partner can therefore drive altmodes to ALTMODEDISCOVERYMAX - 1 via the normal flow, and then send one extra Discover Modes ACK with seven VDOs. Because the pre-loop check passes, the loop could then writes up to five entries past altmodedesc[]. For modedataprime the next field in struct tcpmport is the partneraltmode[] pointer array, which then receives partner-chosen SVID/VDO bytes.

Move the bound check inside the loop so the array can never be indexed past ALTMODEDISCOVERYMAX regardless of how many VDOs the partner supplies or how the function was reached.