CVE-2026-90025: usb: typec: ucsi: displayport: Fix OOB altmode array index
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: displayport: Fix OOB altmode array index
The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM response after checking it is not 0xff. The port altmode array is UCSIMAXALTMODES elements long. If the PPM returns an invalid GETCURRENTCAM response above UCSIMAXALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.
Update the UCSI displayport driver to verify the current cam is less than UCSIMAXALTMODES before accessing the port altmode array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (usb: typec: ucsi: displayport driver)to a version that resolves this vulnerability.Patch usb: typec: ucsi: displayport: Fix OOB altmode array index
Event History
Frequently Asked Questions
What condition is required to trigger the out-of-bounds access?
The USB Type-C UCSI DisplayPort driver must receive a GET_CURRENT_CAM response from the platform policy manager (PPM) that is not 0xff but is greater than or equal to UCSI_MAX_ALTMODES. That value is then used as an index into the connector port altmode array.
What is the practical impact of an invalid GET_CURRENT_CAM response?
An invalid response can cause the kernel to access the altmode array out of bounds and may crash the kernel. The issue is in the UCSI DisplayPort driver path.
How is the issue addressed?
The fix verifies that the current CAM value is less than UCSI_MAX_ALTMODES before using it to access the port altmode array.