CVE-2025-38391

usb: typec: altmodes/displayport: do not index invalid pin_assignments

State: Published
Severity: Not scored
Published: Jul 25, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: altmodes/displayport: do not index invalid pin_assignments

A poorly implemented DisplayPort Alt Mode port partner can indicate that its pin assignment capabilities are greater than the maximum value, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show will cause a BRK exception due to an out of bounds array access.

Prevent for loop in pin_assignment_show from accessing invalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX value in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop condition.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before c93bc959788ed9a1af7df57cb539837bdf790ceeAffected 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 114a977e0f6bf278e05eade055e13fc271f69cf7Affected 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 621d5a3ef0231ab242f2d31eecec40c38ca609c5Affected 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 2f535517b5611b7221ed478527e4b58e29536ddfAffected 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 45e9444b3b97eaf51a5024f1fea92f44f39b50c6Affected 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 5581e694d3a1c2f32c5a51d745c55b107644e1f8Affected 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 47cb5d26f61d80c805d7de4106451153779297a1Affected 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before af4db5a35a4ef7a68046883bfd12468007db38f1Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.4.296 through 5.4.Not affected 5.10.240 through 5.10.Not affected 5.15.187 through 5.15.Not affected 6.1.144 through 6.1.Not affected 6.6.97 through 6.6.Not affected 6.12.37 through 6.12.Not affected 6.15.6 through 6.15.*Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before c93bc959788ed9a1af7df57cb539837bdf790ceeAffected
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 114a977e0f6bf278e05eade055e13fc271f69cf7Affected
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 621d5a3ef0231ab242f2d31eecec40c38ca609c5Affected
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 2f535517b5611b7221ed478527e4b58e29536ddfAffected
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 45e9444b3b97eaf51a5024f1fea92f44f39b50c6Affected
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 5581e694d3a1c2f32c5a51d745c55b107644e1f8Affected
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before 47cb5d26f61d80c805d7de4106451153779297a1Affected
0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 to before af4db5a35a4ef7a68046883bfd12468007db38f1Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.4.296 through 5.4.*Not affected
5.10.240 through 5.10.*Not affected
5.15.187 through 5.15.*Not affected
6.1.144 through 6.1.*Not affected
6.6.97 through 6.6.*Not affected
6.12.37 through 6.12.*Not affected
6.15.6 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.