CVE-2025-38391: usb: typec: altmodes/displayport: do not index invalid pin_assignments
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: altmodes/displayport: do not index invalid pinassignments
A poorly implemented DisplayPort Alt Mode port partner can indicate that its pin assignment capabilities are greater than the maximum value, DPPINASSIGNF. In this case, calls to pinassignmentshow will cause a BRK exception due to an out of bounds array access.
Prevent for loop in pinassignmentshow from accessing invalid values in pinassignments by adding DPPINASSIGNMAX value in typecdp.h and using i < DPPINASSIGNMAX as a loop condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38391?
CVE-2025-38391 is classified as a medium severity vulnerability in the Linux kernel.
What impact does CVE-2025-38391 have on affected systems?
CVE-2025-38391 can lead to the improper handling of DisplayPort Alt Mode pin assignments, potentially resulting in denial of service.
How do I fix CVE-2025-38391?
To fix CVE-2025-38391, ensure that you update your Linux kernel to the latest version where the vulnerability has been patched.
When was CVE-2025-38391 disclosed?
CVE-2025-38391 was disclosed as part of the ongoing security updates for the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2025-38391?
CVE-2025-38391 affects certain versions of the Linux kernel that implement USB Type-C DisplayPort Alt Mode.