In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: Correct the PDO counting in pd_set
Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are incorrectly added one. The index of the loop is equal to the number of PDOs to be updated when leaving the loop and it doesn't need to be added one.
When doing the power negotiation, TCPM relies on the "nr_snk_pdo" as the size of the local sink PDO array to match the Source capabilities of the partner port. If the off-by-one overflow occurs, a wrong RDO might be sent and unexpected power transfer might happen such as over voltage or over current (than expected).
"nr_src_pdo" is used to set the Rp level when the port is in Source role. It is also the array size of the local Source capabilities when filling up the buffer which will be sent as the Source PDOs (such as in Power Negotiation). If the off-by-one overflow occurs, a wrong Rp level might be set and wrong Source PDOs will be sent to the partner port. This could potentially cause over current or port resets.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade kernel-rt-develUpgrade kselftests-kmp-64kbUpgrade dtb-hisiliconUpgrade dtb-renesasUpgrade kernel-default-develUpgrade kernel-64kb-develUpgrade kernel-debug-develUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade kernel-macrosUpgrade kernel-64kbUpgrade kernel-azure-extraUpgrade dtb-mediatekUpgrade kernel-develUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-source-azureUpgrade kernel-default-optionalUpgrade kernel-devel-rtUpgrade kernel-zfcpdumpUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dtb-armUpgrade dtb-amdUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade dlm-kmp-64kbUpgrade dtb-amazonUpgrade kernel-default-livepatch-develUpgrade dtb-appleUpgrade dtb-lgUpgrade dtb-socionextUpgrade dtb-exynosUpgrade gfs2-kmp-64kbUpgrade dtb-xilinxUpgrade kernel-devel-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-debugUpgrade kernel-sourceUpgrade kernel-64kb-optionalUpgrade dtb-apmUpgrade ocfs2-kmp-azureUpgrade dtb-freescaleUpgrade dtb-amlogicUpgrade kernel-default-extraUpgrade kernel-symsUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-azureUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-azureUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-vdsoUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-defaultUpgrade kernel-docsUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-optionalUpgrade dtb-caviumUpgrade dtb-broadcomUpgrade kernel-syms-rtUpgrade kernel-default-base-rebuildUpgrade dtb-sprdUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade dlm-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-develUpgrade kernel-azure-develUpgrade kernel-azureUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-docs-htmlUpgrade dtb-nvidiaUpgrade dtb-alteraUpgrade cluster-md-kmp-64kbUpgrade kernel-rtUpgrade dlm-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-64kb-extraUpgrade kernel-source-rtUpgrade kernel-syms-azureUpgrade ocfs2-kmp-64kb | Jun 24, 2024 | May 1, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-oracleUpgrade linux-image-kvmUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-raspiUpgrade linux-image-oem-24.04aUpgrade linux-image-nvidiaUpgrade linux-image-oem-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-intelUpgrade linux-image-azureUpgrade linux-image-genericUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-virtual-hwe-24.04 | Jul 12, 2024 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub