5.2

CVE-2026-63963: linux

CVSS: 5.2v4.0MediumUndergoing analysis
AliasesUBUNTU-CVE-2026-63963DEBIAN-CVE-2026-63963
Published 19-07-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-63963 is a medium (CVSS 5.2) vulnerability in linux. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.2/10
010
Medium · v4.0 (OSV · Ubuntu), selected by version preference
EPSS score
0.21%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 19 · Related 19
OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23221-1SUSE-SU-2026:23231-1SUSE-SU-2026:23237-1

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdm_consume_identity() or svdm_consume_identity_sop_prime() as the device-controlled value could index off of the static arrays, which could leak data.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

+0.01 pp

From 0.20% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu168 products
  • linuxAll versions (No fix recorded) | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.94-1 | < 7.0.12-1
Linux1 product
  • linux≥ f0690a25a140b853b1842fa80faf828601bb47e8, < 6bacd22e1eae77abf089bbdc016270200a8dc83b | ≥ f0690a25a140b853b1842fa80faf828601bb47e8, < 569f7971542eb10025d8a0989b83f28a29d8ba20 | ≥ f0690a25a140b853b1842fa80faf828601bb47e8, < f9d787fbe83127105e42088cca40e5118db0d810 | ≥ f0690a25a140b853b1842fa80faf828601bb47e8, < ed8649f3822e211d025bcab5158af6f8a38c8705 | ≥ f0690a25a140b853b1842fa80faf828601bb47e8, < 8fbc349e8383125dd2d8de1c1e926279d398ab17 | 4.12

3 vendors · 170 products

References

17 links
Show all 17 references