CVE-2025-71108 Details
Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect num_connectors capability The UCSI spec states that the num_connectors field is 7 bits, and the 8th bit is reserved and should be set to zero. Some buggy FW has been known to set this bit, and it can lead to a system not booting. Flag that the FW is not behaving correctly, and auto-fix the value so that the system boots correctly. Found on Lenovo P1 G8 during Linux enablement program. The FW will be fixed, but seemed worth addressing in case it hit platforms that aren't officially Linux supported.
A vulnerability in the Linux kernel's USB Type-C UCSI (USB Type-C Connector System Interface) implementation can lead to boot issues on systems with certain faulty firmware. The UCSI specification indicates that the 'num_connectors' field should be 7 bits, with the 8th bit reserved and set to zero. However, some problematic firmware has been known to incorrectly set this bit, causing the system to fail to boot. This vulnerability was identified on the Lenovo P1 G8 during a Linux enablement program. While the firmware issue will be addressed, the kernel vulnerability has been fixed in case it affects other platforms not officially supported by Linux.
Users can update to the latest version of the Linux kernel where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/07c8d2a109d847775b3b4e2c3294c8e1eea75432 | kernel.org | Patch |
| https://git.kernel.org/stable/c/132fe187e0d940f388f839fe2cde9b84106ad20d | kernel.org | Patch |
| https://git.kernel.org/stable/c/3042a57a8e8bce4a3100c3f6f03dc372aab24943 | kernel.org | Patch |
| https://git.kernel.org/stable/c/30cd2cb1abf4c4acdb1ddb468c946f68939819fb | kernel.org | Patch |
| https://git.kernel.org/stable/c/58941bbb0050e365a98c64f1fc4a9a0ac127dba6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/914605b0de8128434eafc9582445306830748b93 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f72f97d0aee4a993a35f2496bca5efd24827235d | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.13.1, < 5.10.248 >= 5.11, < 5.15.198 >= 5.16, < 6.1.160 >= 6.2, < 6.6.120 >= 6.7, < 6.12.64 >= 6.13, < 6.18.3 4.13 - 6.19 rc1 6.19 rc2 6.19 rc3 6.19 rc4 6.19 rc5 6.19 rc6 6.19 rc7 6.19 rc8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Jan 19, 2026 | CVE Modified | kernel.org |
| Jan 14, 2026 | New CVE Received | kernel.org |