---
id: CVE-2024-35924
title: 'usb: typec: ucsi: Limit read size on v1.2'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: typec: ucsi: Limit read size on v1.2

  Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was
  increased from 16 to 256. In order to avoid overflowing …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bdc62f2bae8fb0e8e99574de5232f0a3c54a27df <
    af9bdf05557dc21040df2f11062133dd1e503a09
  - >-
    Linux >= bdc62f2bae8fb0e8e99574de5232f0a3c54a27df <
    266f403ec47573046dee4bcebda82777ce702c40
  - >-
    Linux >= bdc62f2bae8fb0e8e99574de5232f0a3c54a27df <
    0defcaa09d3b21e8387829ee3a652c43fa91e13f
  - >-
    Linux >= bdc62f2bae8fb0e8e99574de5232f0a3c54a27df <
    b3db266fb031fba88c423d4bb8983a73a3db6527
  - Linux 5.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-05-20T15:11:13.299971Z'
published: '2024-05-19'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:18:20.791Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-35924'
references:
  - url: 'https://git.kernel.org/stable/c/af9bdf05557dc21040df2f11062133dd1e503a09'
  - url: 'https://git.kernel.org/stable/c/266f403ec47573046dee4bcebda82777ce702c40'
  - url: 'https://git.kernel.org/stable/c/0defcaa09d3b21e8387829ee3a652c43fa91e13f'
  - url: 'https://git.kernel.org/stable/c/b3db266fb031fba88c423d4bb8983a73a3db6527'
tags:
  - cve.org
epss: 0.00219
epssPercentile: 0.12486
ingestedAt: '2026-11-03T12:44:28.812Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Limit read size on v1.2

Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was
increased from 16 to 256. In order to avoid overflowing reads for older
systems, add a mechanism to use the read UCSI version to truncate read
sizes on UCSI v1.2.

## Affected

- `Linux >= bdc62f2bae8fb0e8e99574de5232f0a3c54a27df < af9bdf05557dc21040df2f11062133dd1e503a09`
- `Linux >= bdc62f2bae8fb0e8e99574de5232f0a3c54a27df < 266f403ec47573046dee4bcebda82777ce702c40`
- `Linux >= bdc62f2bae8fb0e8e99574de5232f0a3c54a27df < 0defcaa09d3b21e8387829ee3a652c43fa91e13f`
- `Linux >= bdc62f2bae8fb0e8e99574de5232f0a3c54a27df < b3db266fb031fba88c423d4bb8983a73a3db6527`
- `Linux 5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.