CVE-2024-26995: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26995 affects the Linux kernel's USB Type-C Port Manager (TCPM) implementation. The vulnerability stems from off-by-one errors in the PDO (Power Data Object) counting functionality within the pd_set function, where nr_snk_pdo and nr_src_pdo values are incorrectly incremented. This vulnerability was discovered and disclosed in May 2024, affecting Linux kernel versions from 6.8 up to (excluding) 6.8.8, as well as various release candidates of version 6.9 (NVD).

The vulnerability is classified as an off-by-one error (CWE-193) with a CVSS v3.1 base score of 7.8 (High), requiring local access with low attack complexity. The issue occurs in the TCPM subsystem where the index of the loop equals the number of PDOs to be updated when leaving the loop, but is incorrectly incremented by one. This affects both nr_snk_pdo and nr_src_pdo calculations in the pd_set function (Kernel Patch).

The vulnerability can lead to two primary impacts during power negotiation: 1) When TCPM uses nr_snk_pdo as the size of the local sink PDO array, a wrong Request Data Object (RDO) might be sent, potentially causing unexpected power transfer including over-voltage or over-current conditions. 2) When nr_src_pdo is used to set the Rp level in Source role, it can result in incorrect Rp level settings and wrong Source PDOs being sent to the partner port, potentially causing over-current conditions or port resets (Kernel Patch).

The vulnerability requires local access with low attack complexity and low privileges to exploit. The attack vector is local (AV:L) and requires no user interaction (UI:N) to execute, making it relatively straightforward to exploit for an attacker with local access to the system (NVD).

The vulnerability has been patched in the Linux kernel through commits that correct the PDO counting in pd_set function. The fix removes the incorrect increment of nr_snk_pdo and nr_src_pdo values. Users should update to Linux kernel version 6.8.8 or later to address this vulnerability (Kernel Patch).