CVE-2025-71108: usb: typec: ucsi: Handle incorrect num_connectors capability
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: Handle incorrect numconnectors capability
The UCSI spec states that the numconnectors field is 7 bits, and the 8th bit is reserved and should be set to zero. Some buggy FW has been known to set this bit, and it can lead to a system not booting. Flag that the FW is not behaving correctly, and auto-fix the value so that the system boots correctly.
Found on Lenovo P1 G8 during Linux enablement program. The FW will be fixed, but seemed worth addressing in case it hit platforms that aren't officially Linux supported.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71108?
The severity of CVE-2025-71108 is classified as medium due to its potential impact on device connectivity within the Linux kernel.
How do I fix CVE-2025-71108?
To fix CVE-2025-71108, update to the latest version of the Linux kernel that includes the patch addressing this vulnerability.
What systems are affected by CVE-2025-71108?
CVE-2025-71108 affects systems running specific versions of the Linux kernel that utilize UCSI for USB Type-C support.
What are the implications of CVE-2025-71108?
The implications of CVE-2025-71108 include potential mismanagement of USB Type-C capabilities, leading to connection issues or security vulnerabilities.
When was CVE-2025-71108 disclosed?
CVE-2025-71108 was disclosed as a vulnerability in the Linux kernel, highlighting an issue with the handling of the num_connectors capability.