vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-90025

usb: typec: ucsi: displayport: Fix OOB altmode array index

HIGH
7.7
CVSS Score
Published: September 16, 2026 at 10:33 AM UTC
Updated: October 19, 2026 at 09:18 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.7
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error. Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
5.2af8622f6a585d8d82b11cd7987e082861fd0edd3
Vendor states this is fixed in 04cec690b1fd9d1c4c314b91a10d8c68a3acfe18 (fixed)
Vendor states this is fixed in 1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456 (fixed)
Vendor states this is fixed in 33a81acd2d1d0667d4eff93cb90339fa53e617e8 (fixed)
Vendor states this is fixed in 58e0ee293ec5e06cacbe3953ad44042f1473dae9 (fixed)
Vendor states this is fixed in 83f1abd62cc134700ba92e1e2dc650a49a185497 (fixed)
Vendor states this is fixed in 8fde7e4a366184e9a6aa95541e52933a73c00a74 (fixed)
Vendor states this is fixed in ac9f878c468052af6571e8639ab1c3ae040b908f (fixed)
Vendor states this is fixed in bdaaf3074aedce8f1b173cc363d61cff5f6a585f (fixed)
Vendor states this is fixed in 5.10.270 (unaffected)
Vendor states this is fixed in 5.15.221 (unaffected)
Vendor states this is fixed in 5.2 (unaffected)
Vendor states this is fixed in 6.1.188 (unaffected)
Vendor states this is fixed in 6.12.110 (unaffected)
Vendor states this is fixed in 6.18.51 (unaffected)
Vendor states this is fixed in 6.6.157 (unaffected)
Vendor states this is fixed in 7.2.5 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/8fde7e4a366184e9a6aa95541e52933a73c00a74
Source: cverecord
https://git.kernel.org/stable/c/83f1abd62cc134700ba92e1e2dc650a49a185497
Source: cverecord
https://git.kernel.org/stable/c/1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456
Source: cverecord
https://git.kernel.org/stable/c/58e0ee293ec5e06cacbe3953ad44042f1473dae9
Source: cverecord
https://git.kernel.org/stable/c/ac9f878c468052af6571e8639ab1c3ae040b908f
Source: cverecord
https://git.kernel.org/stable/c/33a81acd2d1d0667d4eff93cb90339fa53e617e8
Source: cverecord
https://git.kernel.org/stable/c/bdaaf3074aedce8f1b173cc363d61cff5f6a585f
Source: cverecord
https://git.kernel.org/stable/c/04cec690b1fd9d1c4c314b91a10d8c68a3acfe18

CVSS

7.7HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card