CVE-2024-26995

What it actually does

Off-by-one error in nr_snk_pdo and nr_src_pdo array sizing causes incorrect PDO counts during USB Power Delivery negotiation, resulting in malformed RDOs, wrong Rp levels, or invalid Source PDOs that enable over-voltage, over-current, or port resets.

Why it matters to the business

Devices using affected kernels may experience unstable or unsafe USB-C power delivery, risking hardware damage, unexpected resets, or failed charging on affected Linux systems; low immediate risk given absent KEV listing and flat EPSS trend.

How an attack unfolds

An attacker with physical or adjacent access to a USB-C port presents manipulated Source or Sink capabilities; the kernel miscounts PDOs and issues an out-of-bounds power request or incorrect Rp value, leading to power transfer outside expected limits or port instability.

How to fix it

Apply kernel patch f3da3192cdd3fefe213390e976eec424a8e270b5 (or equivalent stable backport) to correct PDO counting; rebuild and deploy updated kernel images; verify with fixed commit 3650eea7277a5c278063214a5b71dbd7d77fc5aa where applicable.

How to confirm the fix worked

Confirm kernel source contains the corrected loop indexing for nr_snk_pdo/nr_src_pdo; test PD negotiation with valid and boundary PDO counts; monitor for absence of spurious over-current or reset events during capability exchange.

Typical attack path

1. Gain physical or USB-C adjacent access to target port
2. Present forged Source/Sink PDO capabilities during PD negotiation
3. Trigger kernel off-by-one miscount of nr_snk_pdo or nr_src_pdo
4. Induce over-voltage, over-current, or port reset behavior

How to detect it

Inspect kernel logs for USB typec/tcpm messages indicating unexpected PDO counts or power negotiation failures; correlate with dmesg entries around USB-C attach events; no widespread exploitation artifacts reported.

What your security team should do

• Prioritize kernel update on systems with USB-C/PD support within standard patch cycles
• Review downstream dependents for Linux kernel usage and schedule coordinated upgrades
• Add USB PD capability exchange logging to detect anomalous voltage/current requests