CVE-2026-90025

usb: typec: ucsi: displayport: Fix OOB altmode array index

State: Published
Severity: 7.7 High
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: displayport: Fix OOB altmode array index

The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.

Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 8fde7e4a366184e9a6aa95541e52933a73c00a74Affected af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 83f1abd62cc134700ba92e1e2dc650a49a185497Affected af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456Affected af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 58e0ee293ec5e06cacbe3953ad44042f1473dae9Affected af8622f6a585d8d82b11cd7987e082861fd0edd3 to before ac9f878c468052af6571e8639ab1c3ae040b908fAffected af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 33a81acd2d1d0667d4eff93cb90339fa53e617e8Affected af8622f6a585d8d82b11cd7987e082861fd0edd3 to before bdaaf3074aedce8f1b173cc363d61cff5f6a585fAffected af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 04cec690b1fd9d1c4c314b91a10d8c68a3acfe18Affected
LinuxLinux	5.2Affected before 5.2Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 8fde7e4a366184e9a6aa95541e52933a73c00a74Affected
af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 83f1abd62cc134700ba92e1e2dc650a49a185497Affected
af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456Affected
af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 58e0ee293ec5e06cacbe3953ad44042f1473dae9Affected
af8622f6a585d8d82b11cd7987e082861fd0edd3 to before ac9f878c468052af6571e8639ab1c3ae040b908fAffected
af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 33a81acd2d1d0667d4eff93cb90339fa53e617e8Affected
af8622f6a585d8d82b11cd7987e082861fd0edd3 to before bdaaf3074aedce8f1b173cc363d61cff5f6a585fAffected
af8622f6a585d8d82b11cd7987e082861fd0edd3 to before 04cec690b1fd9d1c4c314b91a10d8c68a3acfe18Affected

LinuxLinux

5.2Affected
before 5.2Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.