Out-of-bounds read in Linux kernel - CVE-2026-64330

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU139652

Out-of-bounds read in Linux kernel - CVE-2026-64330

Published: July 27, 2026


Vulnerability identifier: #VU139652
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64330
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause incorrect registration of alternate modes.

The vulnerability exists due to an out-of-bounds read in svdm_consume_modes() when processing partner-supplied SVDM Discovery Modes data. A remote attacker can inject crafted SVDM values and drive the SVID index out of bounds to cause incorrect registration of alternate modes.

The issue can read adjacent fields in struct tcpm_port, and a connected USB Type-C partner can influence the loaded SVID value.


Affected software

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-kvm (Ubuntu package)
linux-gcp (Ubuntu package)
linux-aws (Ubuntu package)
linux-azure (Ubuntu package)
linux-raspi (Ubuntu package)
linux-oracle (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-gke (Ubuntu package)
linux-aws-5.15 (Ubuntu package)
linux-lowlatency-hwe-5.15 (Ubuntu package)
linux-hwe-5.15 (Ubuntu package)
linux-fips (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-azure-fde-5.15 (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-realtime (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-gkeop (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-ibm-5.15 (Ubuntu package)
linux-ibm (Ubuntu package)
linux-intel-iotg-5.15 (Ubuntu package)
linux-oracle-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-xilinx-zynqmp (Ubuntu package)
linux-intel-iot-realtime (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux-aws-fips (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-hwe-6.8 (Ubuntu package)
linux-lowlatency-hwe-6.8 (Ubuntu package)
linux-azure-fde-6.8 (Ubuntu package)
linux-oracle-6.8 (Ubuntu package)
linux-azure-6.8 (Ubuntu package)
linux-aws-6.8 (Ubuntu package)
linux-nvidia-lowlatency (Ubuntu package)
linux-ibm-6.8 (Ubuntu package)
linux-gcp-6.8 (Ubuntu package)
linux-raspi-realtime (Ubuntu package)
linux-realtime-6.8 (Ubuntu package)
linux-nvidia-bos (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-aws-7.0 (Ubuntu package)
linux-nvidia-7.0 (Ubuntu package)

How to mitigate CVE-2026-64330

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 5.15.0-198.208, 6.8.0-147.147, 7.0.0-31.31
linux-kvm (Ubuntu package) - update to 5.15.0-1109.114
linux-gcp (Ubuntu package) - addressed in versions 5.15.0-1118.128, 6.8.0-1071.79, 7.0.0-1011.11
linux-aws (Ubuntu package) - addressed in versions 5.15.0-1117.124, 6.8.0-1067.70, 7.0.0-1012.12
linux-azure (Ubuntu package) - addressed in versions 5.15.0-1123.132, 6.8.0-1071.79, 7.0.0-1014.14
linux-raspi (Ubuntu package) - addressed in versions 5.15.0-1113.116, 6.8.0-1068.72, 7.0.0-1019.19
linux-oracle (Ubuntu package) - addressed in versions 5.15.0-1114.120, 6.8.0-1064.67, 7.0.0-1011.11
linux-lowlatency (Ubuntu package) - addressed in versions 5.15.0-195.205, 6.8.0-147.147.1
linux-gke (Ubuntu package) - addressed in versions 5.15.0-1113.119, 6.8.0-1066.74, 7.0.0-1006.7
linux-aws-5.15 (Ubuntu package) - update to 5.15.0-1117.124~20.04.1
linux-lowlatency-hwe-5.15 (Ubuntu package) - update to 5.15.0-195.205~20.04.1
linux-hwe-5.15 (Ubuntu package) - update to 5.15.0-198.208~20.04.1
linux-fips (Ubuntu package) - addressed in versions 5.15.0-198.208+fips1, 6.8.0-147.147+fips1
linux-azure-5.15 (Ubuntu package) - update to 5.15.0-1123.132~20.04.1
linux-azure-fde-5.15 (Ubuntu package) - update to 5.15.0-1122.131~20.04.1
linux-nvidia-tegra (Ubuntu package) - addressed in versions 5.15.0-1070.72, 6.8.0-1038.42
linux-realtime (Ubuntu package) - addressed in versions 5.15.0-1116.125, 6.8.1-1062.63, 7.0.0-31.31.1
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1112.113, 6.8.0-1067.70, 7.0.0-1018.18
linux-intel-iotg (Ubuntu package) - update to 5.15.0-1112.118
linux-gkeop (Ubuntu package) - addressed in versions 5.15.0-1100.108, 6.8.0-1052.56
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-ibm-5.15 (Ubuntu package) - update to 5.15.0-1111.115~20.04.1
linux-ibm (Ubuntu package) - addressed in versions 5.15.0-1111.115, 6.8.0-1067.68, 7.0.0-1013.13
linux-intel-iotg-5.15 (Ubuntu package) - update to 5.15.0-1112.118~20.04.1
linux-oracle-5.15 (Ubuntu package) - update to 5.15.0-1114.120~20.04.1
linux-gcp-5.15 (Ubuntu package) - update to 5.15.0-1118.128~20.04.1
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux-azure-fde (Ubuntu package) - addressed in versions 5.15.0-1122.131, 6.8.0-1069.76
linux-xilinx-zynqmp (Ubuntu package) - update to 5.15.0-1080.84
linux-intel-iot-realtime (Ubuntu package) - update to 5.15.0-1109.111
linux-gcp-fips (Ubuntu package) - addressed in versions 5.15.0-1118.128+fips1, 6.8.0-1071.79+fips1
linux-aws-fips (Ubuntu package) - addressed in versions 5.15.0-1117.124+fips1, 6.8.0-1067.70+fips1
linux-azure-fips (Ubuntu package) - addressed in versions 5.15.0-1123.132+fips1, 6.8.0-1071.79+fips1
linux-hwe-6.8 (Ubuntu package) - update to 6.8.0-149.149~22.04.1
linux-lowlatency-hwe-6.8 (Ubuntu package) - update to 6.8.0-149.149.1~22.04.1
linux-azure-fde-6.8 (Ubuntu package) - update to 6.8.0-1071.78~22.04.1
linux-oracle-6.8 (Ubuntu package) - update to 6.8.0-1067.71~22.04.1
linux-azure-6.8 (Ubuntu package) - update to 6.8.0-1073.82~22.04.1
linux-aws-6.8 (Ubuntu package) - update to 6.8.0-1069.74~22.04.1
linux-nvidia-lowlatency (Ubuntu package) - update to 6.8.0-1067.70.1
linux-ibm-6.8 (Ubuntu package) - update to 6.8.0-1069.70~22.04.1
linux-gcp-6.8 (Ubuntu package) - update to 6.8.0-1073.81~22.04.1
linux-raspi-realtime (Ubuntu package) - update to 6.8.0-2056.58
linux-realtime-6.8 (Ubuntu package) - update to 6.8.1-1064.65~22.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2018.18
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-31.31~24.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13
linux-aws-7.0 (Ubuntu package) - update to 7.0.0-1012.12~24.04.1
linux-nvidia-7.0 (Ubuntu package) - update to 7.0.0-1018.18~24.04.1

External References

Related Security Bulletins