{"id":"CVE-2026-90025","revision":"d8e89a75e693483297da6eba6899bc44","records":[{"revision":"d8e89a75e693483297da6eba6899bc44","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90025","aliases":[],"title":"usb: typec: ucsi: displayport: Fix OOB altmode array index","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: displayport: Fix OOB altmode array index\n\nThe UCSI displayport driver indexes the connector's port altmode array\nwith the GET_CURRENT_CAM response after checking it is not 0xff. The\nport altmode array is UCSI_MAX_ALTMODES elements long. If the PPM\nreturns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and\nnot equal to 0xff, the kernel may crash with an array index OOB error.\n\nUpdate the UCSI displayport driver to verify the current cam is less\nthan UCSI_MAX_ALTMODES before accessing the port altmode array.","state":0,"publishedAt":"2026-09-16T10:33:28.313+00:00","modifiedAt":"2026-10-19T08:56:39.915+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/typec/ucsi/displayport.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"af8622f6a585d8d82b11cd7987e082861fd0edd3\",\n                            \"lessThan\": \"8fde7e4a366184e9a6aa95541e52933a73c00a74\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af8622f6a585d8d82b11cd7987e082861fd0edd3\",\n                            \"lessThan\": \"83f1abd62cc134700ba92e1e2dc650a49a185497\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af8622f6a585d8d82b11cd7987e082861fd0edd3\",\n                            \"lessThan\": \"1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af8622f6a585d8d82b11cd7987e082861fd0edd3\",\n                            \"lessThan\": \"58e0ee293ec5e06cacbe3953ad44042f1473dae9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af8622f6a585d8d82b11cd7987e082861fd0edd3\",\n                            \"lessThan\": \"ac9f878c468052af6571e8639ab1c3ae040b908f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af8622f6a585d8d82b11cd7987e082861fd0edd3\",\n                            \"lessThan\": \"33a81acd2d1d0667d4eff93cb90339fa53e617e8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af8622f6a585d8d82b11cd7987e082861fd0edd3\",\n                            \"lessThan\": \"bdaaf3074aedce8f1b173cc363d61cff5f6a585f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af8622f6a585d8d82b11cd7987e082861fd0edd3\",\n                            \"lessThan\": \"04cec690b1fd9d1c4c314b91a10d8c68a3acfe18\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/typec/ucsi/displayport.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":7.7,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/8fde7e4a366184e9a6aa95541e52933a73c00a74","https://git.kernel.org/stable/c/83f1abd62cc134700ba92e1e2dc650a49a185497","https://git.kernel.org/stable/c/1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456","https://git.kernel.org/stable/c/58e0ee293ec5e06cacbe3953ad44042f1473dae9","https://git.kernel.org/stable/c/ac9f878c468052af6571e8639ab1c3ae040b908f","https://git.kernel.org/stable/c/33a81acd2d1d0667d4eff93cb90339fa53e617e8","https://git.kernel.org/stable/c/bdaaf3074aedce8f1b173cc363d61cff5f6a585f","https://git.kernel.org/stable/c/04cec690b1fd9d1c4c314b91a10d8c68a3acfe18"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90025","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90025","identifiers":["CVE-2026-90025"]},"retained":false,"historicalAffected":[]}],"coverage":[]}