In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: displayport: Fix OOB altmode array index

The UCSI displayport driver indexes the connector's port altmode array
with the GET_CURRENT_CAM response after checking it is not 0xff. The
port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM
returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and
not equal to 0xff, the kernel may crash with an array index OOB error.

Update the UCSI displayport driver to verify the current cam is less
than UCSI_MAX_ALTMODES before accessing the port altmode array.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
af8622f6a585d8d82b11cd7987e082861fd0edd3 affected < 8fde7e4a366184e9a6aa95541e52933a73c00a74
af8622f6a585d8d82b11cd7987e082861fd0edd3 affected < 83f1abd62cc134700ba92e1e2dc650a49a185497
af8622f6a585d8d82b11cd7987e082861fd0edd3 affected < 1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456
af8622f6a585d8d82b11cd7987e082861fd0edd3 affected < 58e0ee293ec5e06cacbe3953ad44042f1473dae9
af8622f6a585d8d82b11cd7987e082861fd0edd3 affected < ac9f878c468052af6571e8639ab1c3ae040b908f
af8622f6a585d8d82b11cd7987e082861fd0edd3 affected < 33a81acd2d1d0667d4eff93cb90339fa53e617e8
af8622f6a585d8d82b11cd7987e082861fd0edd3 affected < bdaaf3074aedce8f1b173cc363d61cff5f6a585f
af8622f6a585d8d82b11cd7987e082861fd0edd3 affected < 04cec690b1fd9d1c4c314b91a10d8c68a3acfe18
Linux Linux affected
Version Status Constraints
5.2 affected —
0 unaffected < 5.2
5.10.270 unaffected ≤ 5.10.*
5.15.221 unaffected ≤ 5.15.*
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.51 unaffected ≤ 6.18.*
7.2.5 unaffected ≤ 7.2.*
7.3-rc2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/04cec690b1fd9d1c4c314b91a10d8c68a3acfe18 cve-icon cve-icon
https://git.kernel.org/stable/c/1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456 cve-icon cve-icon
https://git.kernel.org/stable/c/33a81acd2d1d0667d4eff93cb90339fa53e617e8 cve-icon cve-icon
https://git.kernel.org/stable/c/58e0ee293ec5e06cacbe3953ad44042f1473dae9 cve-icon cve-icon
https://git.kernel.org/stable/c/83f1abd62cc134700ba92e1e2dc650a49a185497 cve-icon cve-icon
https://git.kernel.org/stable/c/8fde7e4a366184e9a6aa95541e52933a73c00a74 cve-icon cve-icon
https://git.kernel.org/stable/c/ac9f878c468052af6571e8639ab1c3ae040b908f cve-icon cve-icon
https://git.kernel.org/stable/c/bdaaf3074aedce8f1b173cc363d61cff5f6a585f cve-icon cve-icon
History

Wed, 16 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error. Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
Title usb: typec: ucsi: displayport: Fix OOB altmode array index
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-16T10:33:28.313Z

Reserved: 2026-09-11T19:38:34.782Z

Link: CVE-2026-90025

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-16T11:17:15.487

Modified: 2026-09-16T11:17:15.487

Link: CVE-2026-90025

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.